AI Web Agents Have No Reliable Prompt Injection Defenses, Benchmark Finds
Researchers ran 3,168 adversarial tests against GPT-5 and Gemini-powered agents. The 'Robust Behavior' outcome, agent completes task, attacker gets nothing, never appeared.
Key points
- StakeBench ran 3,168 adversarial tests across NanoBrowser and BrowserUse, finding no configuration that consistently blocked attacks.
- Indirect prompt injection hit between 41.67% and 68.16% success; direct injection cleared 79% across all tested setups.
- Swapping GPT-5 for Gemini-2.5-Flash raised indirect injection success by 26.49 percentage points on NanoBrowser.
- A preliminary image-only test pushed one product's selection rate from 10% to 76.67%, with no text changed.
- Seller-targeted attacks recorded the highest success rates; user-targeted attacks were the hardest to detect because workflows kept running normally.
The Robust Behavior region was unpopulated. Across every attack objective, every configuration, researchers from Nanyang Technological University, ST Engineering, IBM Research, and UIUC found at least one meaningful failure mode. That's the headline and the problem.
What did StakeBench actually test?
StakeBench ran 264 benchmark cases across two AI web agents, NanoBrowser and BrowserUse, producing 3,168 adversarial runs. Indirect prompt injection, where malicious instructions hide inside ordinary web content like product reviews or page metadata, hit between 41.67% and 68.16% attack success depending on configuration. Direct injection cleared 79%. An autonomous agent browsing the web on your behalf is a soft target by default.
Should you worry about the failure modes?
Two pathologies matter here. The first is stealthy parasitism: the agent completes the user's task while simultaneously advancing an attacker's goal. The paper's example is a malicious prompt buried in product reviews that quietly steers the agent toward a specific item. The user gets a recommendation; the recommendation is compromised; nothing looks wrong.
The second is misaligned disruption, where the attack breaks the user's workflow without achieving the attacker's objective. Both are bad. Neither shows up in a single aggregate metric, which is exactly why the researchers built a stakeholder-centric benchmark rather than a simple attack-success-rate score.
We covered how autonomous agent threat models are being rebuilt in practice in our 10 June story on AI red teaming.
Does the model choice matter?
Yes, and so does the architecture around it. Replacing GPT-5 with Gemini-2.5-Flash pushed indirect injection success up 26.49 percentage points on NanoBrowser and 6.2 points on BrowserUse. BrowserUse showed higher behavioral instability than NanoBrowser across both models. Prompt injection resilience is not a property of the language model alone; it's a function of how that model is wired into the broader agent architecture.
What about images?
Nobody checked the images. In a preliminary multimodal test, researchers modified only a product image, leaving all text and ratings untouched. The manipulated product's selection rate jumped from 10% to 76.67%. Visual content alone moved the needle. That's a surface enterprise AI deployments are almost certainly not auditing today.
If you're running autonomous agents against any environment with third-party content, treat the agent's output boundary as an untrusted interface. The postmortem template for this failure mode doesn't exist yet, which means you're writing it after the incident.
