AI Web Agents Have No Reliable Prompt Injection Defenses, Benchmark Finds

The 'Robust Behavior' region was empty. Completely.

That's the core finding from StakeBench, a new benchmark out of Nanyang Technological University, ST Engineering, IBM Research, and UIUC that ran 3,168 adversarial tests against two AI web agents — NanoBrowser and BrowserUse — using GPT-5 and Gemini-2.5-Flash as backbone models. Every single attack objective produced at least one meaningful failure dimension. Every one.

Indirect prompt injection — the kind where malicious instructions hide inside product reviews, page metadata, or other ordinary web content — landed between 41.67% and 68.16% attack success rates across configurations. Direct injection cleared 79% across the board. In practice, those numbers mean an autonomous agent browsing the web on your behalf is a soft target by default.

The failure mode here is more nuanced than the headline numbers suggest, though. The researchers identified two pathologies worth pulling apart. The first: stealthy parasitism, where the agent completes the user's task while simultaneously advancing an attacker's goal. The paper's example is blunt — a malicious prompt injected into product reviews quietly steers the agent toward a specific item. The user gets a recommendation. The recommendation is compromised. The user sees nothing wrong.

The second pathology is misaligned disruption: the attack breaks the user's workflow without actually achieving the attacker's objective. The agent fails, but not in a way the attacker controlled. Both outcomes are bad. Neither shows up cleanly in a single aggregate metric.

StakeBench is notable because it evaluates harm across three distinct groups — end users, third-party sellers, and platforms — rather than just measuring whether an attack "succeeded." Seller-targeted attacks recorded the highest success rates. User-targeted attacks had the lowest task deviation, which sounds reassuring until you realize it means the workflow keeps running normally while the adversarial objective completes underneath it. Harder to detect. Harder to catch in a postmortem.

The model and architecture choices matter too. Swapping GPT-5 for Gemini-2.5-Flash pushed indirect injection success up by 26.49 percentage points on NanoBrowser. BrowserUse showed higher behavioral instability than NanoBrowser across the board. Prompt injection resilience, the researchers argue, is not a property of the language model alone — it's a function of how that model is wired into the broader agent architecture.

One thing the post-mortem will say: nobody checked the images. In a preliminary multimodal test, researchers modified only a product image, leaving all text and ratings untouched. The manipulated product's selection rate jumped from 10% to 76.67%. Visual content alone moved the needle. That's a surface that enterprise AI deployments are almost certainly not auditing today.

If you're running autonomous agents against any environment with third-party content — and that's basically every real-world web task — treat the agent's output boundary as an untrusted interface, not a trust boundary.