LoginTrap induces web agents to log into attacker-controlled pages, hitting 86% end-to-end data leakage across backbones

arXiv·high signalXBlueskyLinkedInCopy link

arXiv 2608.04741 (Aug 5) targets the authentication boundary specifically: a black-box attacker who controls webpage content uses a fuzzing-inspired process to generate page-specific injections that make logging in look like a plausible prerequisite for continuing the user's task, steering the agent to a controlled login page. The attack is task-agnostic — it needs no knowledge of the user's goal or the agent's internals — and reaches 86% average end-to-end attack success across LLM backbones, remaining effective across agent architectures and existing defenses. Credential entry is the one action browser agents should never take autonomously, and no shipped agent currently treats it as a distinct trust boundary.