Technical Summary: TRAP – Task-Redirecting Agent Persuasion Benchmark for Web Agents

Problem Statement

Web-based agents powered by Large Language Models (LLMs) are increasingly deployed for autonomous tasks such as email management, shopping, and professional networking. However, their reliance on dynamic web content renders them vulnerable to prompt injection attacks. Unlike traditional software vulnerabilities, these attacks involve adversarial instructions hidden within ordinary webpage elements (e.g., user comments, event descriptions) that persuade the agent to deviate from its original task.

Existing benchmarks for web-based LLM agents suffer from several limitations:

• Static and Monolithic: They often treat injections as indivisible blocks rather than modular components, failing to evolve with new attack types.
• Lack of Realism: Many rely on simplified sandboxes that poorly approximate popular websites.
• Ambiguous Metrics: Success is often defined by multi-step outcomes evaluated by LLM judges, introducing bias. Furthermore, distinguishing between an agent's refusal to act and its incompetence is difficult.
• Insufficient Analysis: Evaluations often reduce the problem to a binary "success/failure" question without analyzing why or when an injection succeeds.

Real-world incidents, such as Perplexity's Comet browser being misled by Reddit posts and Gemini being manipulated via invisible text in Gmail, highlight the urgent need for rigorous, realistic evaluation methods.

Methodology

The authors introduce TRAP (Task-Redirecting Agent Persuasion Benchmark), built upon the REAL simulation environment, which uses deterministic clones of popular websites.

Experimental Setup

• Environments: Six realistic website clones were selected based on their exposure of user-editable surfaces: Amazon, Gmail, Google Calendar, LinkedIn, DoorDash, and Upwork.
• Agents: Six frontier models were evaluated: GPT-5, Claude Sonnet 3.7, Gemini 2.5 Flash, GPT-OSS-120B, DeepSeek-R1, and LLaMA 4 Maverick.
• Observation Modality: Agents primarily used the Accessibility Tree (AXTree) as the observation modality to ensure broad model support and cost-effectiveness, though screenshots and full HTML were also tested with negligible performance differences.
• Benign Tasks: 18 distinct user tasks (3 per site) were designed, such as checking calendars, reading emails, and booking food delivery.

The Modular Attack Space

TRAP constructs a five-dimensional modular attack space comprising 630 unique task-injection combinations. The components are:

1. Interaction Vector: The mechanism of redirection, either a Button or a Hyperlink.
2. Human Persuasion Principles: Based on Cialdini's principles (Authority, Reciprocity, Scarcity, Liking, Social Proof, Consistency, Unity).
3. LLM Manipulation Methods: Established jailbreak techniques including Adversarial Suffixes, Chain-of-Thought (CoT) injection, Many-shot/Many-turn conditioning, Role-Play/Storytelling, and Override prompts.
4. Injection Location: The specific user-editable field where the injection is placed (e.g., event address, user bio, feed post).
5. Tailoring: Customizing the injection to reference specific elements of the benign task (e.g., changing "access content" to "access meeting details").

Evaluation Metrics

The primary metric is the Attack Success Rate (ASR), defined as a binary outcome: whether the agent clicks the injected element and is redirected to a malicious (pornographic) website. This "one-click" metric isolates the critical security boundary where execution transfers to an attacker-controlled context, enabling downstream threats like data exfiltration. A secondary metric tracks benign task completion rates to assess overall utility.

Key Results

Overall Vulnerability

Across six models and 3,780 runs, the average ASR was 25%.

• GPT-5 demonstrated the highest robustness with an ASR of 13% and high benign utility (89%).
• DeepSeek-R1 was the most vulnerable with an ASR of 43%, despite maintaining solid benign utility (67%).
• LLaMA 4 Maverick showed low benign utility (22%) but a moderate ASR (17%).

Transferability

Attack transferability is asymmetric. Injections that successfully compromise the most robust model (GPT-5) transfer to weaker models at high rates (averaging 82.5%). Conversely, attacks successful against weaker models (e.g., DeepSeek-R1) often fail against stronger ones (transferring at only ~39%). This suggests adversaries can target the strongest agent to develop attacks that generalize to weaker systems.

Component Analysis

• Interaction Vector: Button-based injections are significantly more effective than hyperlinks. Across all models, buttons accounted for 77.5% of successful attacks (approx. 3.5x more effective). For GPT-5, 96.3% of successful injections were button-based.
• Persuasion Principles: Social Proof (18.1%) and Consistency (17.9%) were the most universally successful triggers. However, model-specific weaknesses exist; for instance, DeepSeek-R1 is particularly susceptible to Authority combined with CoT injection.
• Manipulation Methods: Adversarial Suffixes (24.5%), CoT Injection (23.8%), and Many-shot conditioning (23.8%) were the most effective techniques. DeepSeek-R1 failures were almost entirely driven by CoT injection.
• Location: Injections in the About section of LinkedIn (NetworkIn) were significantly more successful (59% with targeting) than in random posts or recommendations, suggesting vulnerabilities cluster around semantically rich profile text.
• Tailoring: Light contextual tailoring (swapping generic phrasing for task-specific wording) sharply increased ASR. For GoCalendar, tailoring increased success rates by 5.6x (from 7 to 39 successful attempts).

Significance and Contributions

The paper claims three primary contributions:

1. Large-Scale Modular Attack Space: TRAP provides a systematic framework to decompose prompt injections into interpretable social-engineering components. This allows researchers to analyze how specific parameters (e.g., persuasion type vs. interface design) interact to influence agent behavior, moving beyond monolithic failure analysis.
2. Expandable Framework: The authors release a modular framework that enables the integration of new injection types and testing on realistic website clones, facilitating controlled cross-model comparisons.
3. Empirical Insights into Systemic Vulnerabilities: The study reveals that web agents are susceptible to psychologically driven attacks. Crucially, it demonstrates that small design choices (e.g., using a button instead of a link, or adding a few words of context) can drastically alter security outcomes, doubling or even sextupling success rates.

Conclusion

TRAP establishes that securing autonomous agents requires addressing not only technical prompt-handling mechanisms but also the persuasive structures embedded in the environments where agents operate. By isolating the "one-click" redirection event, the benchmark provides a reproducible foundation for studying current agent failures and developing robust defenses against social-engineering attacks in web interfaces. The authors note limitations, including the focus on textual injections and the use of cloned environments, but emphasize the framework's utility for controlled, systematic evaluation.