Untrusted Content Masking Gives Web Agents Provable Prompt-Injection Isolation
arXiv·high signal
Extends the strict trusted-instruction/untrusted-data separation that already holds for text and tool-use APIs into the browser, masking untrusted page content so web agents get security guarantees rather than best-effort filtering. It lands amid a reported 340% surge in prompt-injection attacks in 2026 and OWASP naming injection the top agentic-AI failure mode. For builders it offers a guarantee-backed defense pattern for browser agents instead of heuristic content sanitization.