LoginTrap gets web agents to log into attacker pages, 86% end-to-end data leakage.

arXiv 2608.04741 uses a fuzzing-inspired process to generate page-specific injections that make logging in look like a plausible prerequisite for continuing the user's task, steering the agent to a controlled login page. Task-agnostic, black-box, no knowledge of the user's goal or agent internals needed, effective across architectures and existing defenses. Credential entry is the one action a browser agent should never take autonomously, and no shipped agent currently treats it as a distinct trust boundary. That's a design gap you could fix in your own harness this afternoon.