Rebuilding the approval dialog from browser ground truth drops attack success from 68-100% to 0%.

arXiv 2609.18411 targets the case where the human-in-the-loop confirmation is itself attacker-influenced, which is where most agentic-browser defenses quietly assume safety. The Verifiable Action Card reconstructs approval text from the pending browser action and trusted intent provenance, renders it out-of-band in browser chrome, and re-verifies the exact action at dispatch. On a 24-scenario benchmark covering confused-deputy attacks, Lies-in-the-Loop dialog forging and adaptive action substitution: 68-100% attack success without it, 0% on every model with it, at 78% legitimate-task completion and a 0% false-block rate. The zero false-block number is what makes this shippable rather than academic.