Skip to main content
LLM Security Database
Skip to research search
Last analyzed Sep 9, 2026

Language Model Security Database

985 research findings · 1119 evaluated models

Filtered research findings

1 entry

Matches every word across titles, descriptions, sources, affected systems, and models.

Cross-Site Prompt Injection in Web Agents

Published Analyzed Source: arXiv

The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.

Prismata: Confining Cross-Site Prompt Injection in Web Agents
Evaluated models: GPT-5.4, GPT-5.4-mini, GPT-5.4 Nano+4 more
  • GPT-5.4
  • GPT-5.4-mini
  • GPT-5.4 Nano
  • Gemini 3 Flash
  • GPT-oss 120B
  • Qwen 3 8B
  • MiniMax M2.5
Application layer
Computer use
AI agents
Injection

Research methodology

Entries summarize publicly available primary-source security research. Model names reflect only systems explicitly evaluated by the cited paper, and measurements are research-reported unless independent verification is stated.

Discovery and publication are separate: new papers enter a candidate queue, then require human review and explicit approval before publication. Updates follow that review process, not a guaranteed daily publishing schedule. “Last analyzed” is the newest analysis date among published entries; it does not mean that all recent research has been covered.