Context manipulation attacks : Web agents are susceptible to corrupted memory

TL;DR

This paper introduces 'plan injection,' a new type of attack targeting the external memory of web navigation agents, demonstrating significant vulnerabilities and proposing the need for secure memory management in such systems.

Contribution

The paper formalizes 'plan injection' attacks on web agents' memory, showing they bypass defenses and significantly increase success rates in malicious tasks.

Findings

Plan injection attacks achieve up to 3x higher success rates.

Context-chained injections increase privacy exfiltration success by 17.7%.

Vulnerabilities exist due to external memory management in web agents.

Abstract

Autonomous web navigation agents, which translate natural language instructions into sequences of browser actions, are increasingly deployed for complex tasks across e-commerce, information retrieval, and content discovery. Due to the stateless nature of large language models (LLMs), these agents rely heavily on external memory systems to maintain context across interactions. Unlike centralized systems where context is securely stored server-side, agent memory is often managed client-side or by third-party applications, creating significant security vulnerabilities. This was recently exploited to attack production systems. We introduce and formalize "plan injection," a novel context manipulation attack that corrupts these agents' internal task representations by targeting this vulnerable context. Through systematic evaluation of two popular web agents, Browser-use and Agent-E, we show that plan injections bypass robust prompt injection defenses, achieving up to 3x higher attack success rates than comparable prompt-based attacks. Furthermore, "context-chained injections," which craft logical bridges between legitimate user goals and attacker objectives, lead to a 17.7% increase in success rate for privacy exfiltration tasks. Our findings highlight that secure memory handling must be a first-class concern in agentic systems.