FlagThis

Abstract

Autonomous web agents promise to automate everyday browsing tasks, but inherit one of the webs oldest attack surfaces. CrossSite Scripting proved that mixing trusted and untrusted content is dangerous, even on benign pages. Agents resurface this risk by interpreting natural language as instructions, allowing third-party and user-generated content to hijack the agent via prompt injection. The core challenge is that deriving a task-specific security policy requires reasoning over page structure that is entangled with the attackers content. We present Prismata, a defense enforcing _contextual least privilege_ for web agents, constraining both what the agent sees and what it can do. Prismatas _dynamic trust derivation_ produces permission labels for page content, with _structural confinement_ guarantees, inspired by classical integrity models, that bound any labeling errors so that labels can only decrease in privilege and mislabelings are bounded. Prismatas _mechanical confinement_ enforces these labels by redacting content and restricting agent capabilities. Importantly, these mechanisms require no developer annotations, so Prismata supports the long tail of websites. Across recent published web agent attacks, including adaptive variants, Prismata substantially reduces attack success while preserving benign task utility.