ai-research-survey

scan.json (35122B)

---

 {
   "paper": {
     "title": "When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent",
     "authors": [
       "Xinyi Wu",
       "Geng Hong",
       "Yueyue Chen",
       "MingXuan Liu",
       "Feier Jin",
       "Xudong Pan",
       "Jiarun Dai",
       "Baojun Liu"
     ],
     "year": 2026,
     "venue": "arXiv.org",
     "arxiv_id": "2601.07263",
     "doi": "10.48550/arXiv.2601.07263"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "Web automation agents are highly vulnerable to social engineering attacks (AGENTBAIT), with an average attack success rate of 67.5% across five mainstream frameworks and peaks above 80% for trusted identity forgery and permission abuse objectives. The proposed SUPERVISOR defense module, which enforces joint environment and intention consistency checks at runtime, reduces attack success rates by 78.1% on average with only 7.7% runtime overhead. Intrinsic LLM safety mechanisms offer only partial protection, primarily against explicit sensitive data requests (67.7% refusal rate) while largely ignoring permission abuse (3-17% refusal rate). Real-world website evaluations confirm the synthetic benchmark findings, with reduced raw ASR attributable to agent capability limitations rather than improved security.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "An anonymous repository URL is provided in footnote 1: https://anonymous.4open.science/r/AgentBait_3283. The Ethics section states they 'release sanitized task specifications and deceptive pages that allow reproducibility.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The Ethics section states 'we release sanitized task specifications and deceptive pages that allow reproducibility without enabling misuse.' The anonymous repository link is provided. They also reference WebVoyager's publicly available sampled data for usability evaluation."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Table 10 (Appendix A) lists startup methods and framework versions for each web agent but does not provide requirements.txt, Dockerfile for the evaluation harness, or detailed library version specifications needed to recreate the evaluation environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README with commands, or scripts to replicate experiments are described in the paper. The methodology is documented but lacks concrete reproduction steps."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., 67.5% average ASR, 78.1% reduction) without confidence intervals, error bars, or uncertainty bounds."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses a chi-square consistency test only in Section 5.3.2 for model dependency analysis. However, the primary comparative claims (e.g., SUPERVISOR vs. other defenses, differences across inducement types) are made by comparing raw percentages without any significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported as relative and absolute changes with baseline context throughout: '78.1% decrease relative to baseline,' '14.3% drop once authority cues eliminated' (Section 4.3.1), 'ASR of 78.4% (+23%)' (Table 5), and SUPERVISOR overhead as '7.7%' with per-agent breakdowns."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The benchmark contains 500 tasks (5 scenarios × 100 quadruples) and various subsets for ablation studies, but no power analysis or justification for why these sample sizes are sufficient for the claims made."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported for any experimental results. It is unclear whether experiments were run multiple times or represent single runs."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The defense evaluation (Section 5.3.1) compares SUPERVISOR against four baseline defense frameworks: Task-Specific, Safety-Prompt, AGrail, and ATHENA, plus a no-defense condition. The attack evaluation uses no-defense as baseline."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include AGrail (2025), ATHENA (2024), and prompt-based defenses from recent OWASP and safety literature. The paper justifies excluding full-stack defenses (IsolateGPT, ACE) as requiring 'unfeasible developing and running overhead' (Section 5.3.1)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablation studies are conducted: context consistency illusion experiment with four inducement conditions (Table 5), authority trust bias ablation removing authority cues (Figure 4), analysis of individual inducement contexts (Table 4) and attack objectives (Table 6), and timing/placement effects (Appendix C, Table 12)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Evaluation uses attack success rate (ASR) for attack effectiveness, task completion rate for usability (Table 9), and relative execution time overhead for efficiency (Figure 9). Failure cases are categorized into refusal, timeout, block, invalid, and other types."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "Evaluation is entirely automated: rule-based string matching and an auxiliary LLM judge for validation (Section 4.1.3). Manual verification is mentioned only for checking failure distributions (Table 7), not for primary outcome assessment."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No separation of development and test sets is described. The same 500-task benchmark appears to be used for all evaluations. SUPERVISOR's prompts (Appendix D) may have been designed or tuned on the same tasks used for evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Extensive breakdowns are provided: by consistency pattern (Table 3), by inducement context type (Table 4), by attack objective (Table 6), by failure reason (Table 7), by defense framework per agent (Figure 8), and by real-world failure type (Figure 6)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3.3 qualitatively analyzes 50 cases where SUPERVISOR was bypassed, identifying three failure modalities: overlooked semantic conflict, incorrect permission inference, and ambiguous sensitivity recognition. Table 7 and Figure 6 categorize all failure types."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: SUPERVISOR fails in 50 analyzed cases (Section 5.3.3), task completion drops 2.7% with SUPERVISOR (Table 9), Semantic Drift shows partial resistance (Table 5), and the paper acknowledges that LLM uncertainty limits verification reliability (Section 6.2)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: 67.5% average ASR (Table 3), peaks above 80% under trusted entity (75.8%) and specific patterns (81.0% at α=0,γ=+1, Table 3), 78.1% ASR reduction (Figure 8), 7.7% runtime overhead (Figure 9), and usability preservation (Table 9)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims about context consistency illusion and authority trust bias are supported by controlled ablation experiments. Table 5 manipulates inducement wording conditions (four conditions including control). Figure 4 removes authority cues while keeping other content unchanged. These are adequate single-variable manipulations."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.2 explicitly bounds claims: 'our experiments are limited to open-source web agent frameworks,' acknowledges that 'commercial web agents remain scarce and largely experimental,' and notes that 'covering the full spectrum of social engineering risks is inherently difficult.' The scope of AGENTBAIT is defined in Section 3.1.3."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for its main findings. For example, it does not consider whether the high ASR could be inflated by overly simplistic synthetic webpages, whether the benchmark tasks generated by Gemini-2.0-Flash introduce a systematic bias, or whether SUPERVISOR's effectiveness is partially due to the additional latency introduced by consistency checks."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper defines attack success concretely: 'the planner's action log is analyzed to determine whether the action types, target attributes, or input values correspond to these annotated elements' (Section 4.1.3). This proxy closely matches the actual security outcome. The validation methodology is well-defined with specific examples."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 'GPT-4o' throughout without specifying a snapshot date or API version. Table 8 lists models as 'GPT-4,' 'GPT-5,' 'Qwen3-8B,' etc. — all marketing names without version identifiers. Gemini-2.0-Flash is used for task generation without a version. The schema requires specific versions like 'gpt-4o-2024-05-13.'"
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix D provides complete prompts for all four SUPERVISOR decision modules (environment consistency check, user task analysis, action semantics classification, input sensitivity classification). Appendix B includes the prompt template for batch webpage generation. Table 10 quotes framework-level safety prompts."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No LLM hyperparameters (temperature, top-p, max tokens) are reported for either the web agent frameworks or SUPERVISOR's internal model calls. Section 4.1.1 states 'deployed with default configurations' without specifying what those defaults are."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "SUPERVISOR's pipeline is described in detail in Section 5.2: environment consistency checker, intention consistency checker with permission/sensitivity policies, decision engine, and two hooking strategies (function-level and process-level). Figure 7 illustrates the full pipeline. Web agent architectures are described in Section 2.1 and Table 10."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.2 documents the task construction pipeline: Cartesian product of 5 inducement contexts × 4 attack objectives = 20 classes, instantiated under 5 patterns = 100 quadruples, contextualized across 5 scenarios = 500 tasks. Appendix B details the webpage generation prompt and injection methodology."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.2 'Limitations' contains three substantive paragraphs discussing limitations to open-source frameworks, coverage of SE attack types, and LLM reasoning uncertainty affecting SUPERVISOR."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.2 discusses specific threats: limitation to open-source frameworks (not commercial), inherent difficulty of covering all SE tactics (mitigated by drawing from well-studied manipulations), and SUPERVISOR's susceptibility to LLM hallucination on ambiguous tasks. Section 5.3.3 identifies three specific failure modalities."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.2 explicitly states: experiments limited to open-source frameworks, commercial agents not assessed, full spectrum of SE risks not covered. Section 3.1.3 states 'Our study focuses on behavioral manipulation during task execution' and that 'Network-level protections are orthogonal to our study.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The anonymous repository provides sanitized task specifications and deceptive pages, but raw agent execution logs, action traces, and validation annotations are not described as being released."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.1 describes web agent selection criteria (>1,000 GitHub stars, active maintenance, or academic prototypes from leading venues). Section 4.1.2 details task construction methodology. Section 4.1.3 describes the validation procedure. Appendix B provides the generation prompt and scenario details."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1.1 describes the selection of web agent frameworks: open-source projects with >1,000 GitHub stars and active maintenance (Browser Use, Skyvern-AI, Agent-E) plus academic prototypes from leading AI venues (LiteWebAgent, SeeAct). For real-world validation, 26 websites were drawn as a stratified sample from WebVoyager."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: attack vector taxonomy (Section 3.2) → Cartesian product to create 100 quadruples (Section 4.1.2) → contextualization across 5 scenarios → batch generation with Gemini-2.0-Flash → Flask hosting → agent execution with logging → rule-based and LLM-based validation (Section 4.1.3). Appendix B provides the generation template."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, grant numbers, or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Fudan University, Zhongguancun Laboratory, Shanghai Innovation Institute, and Tsinghua University. These are academic institutions not affiliated with the evaluated web agent frameworks."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence of funder cannot be assessed. The authors are from academic institutions not affiliated with any of the evaluated frameworks, which suggests independence, but the absence of explicit disclosure fails this criterion."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests attack/defense effectiveness against web agent frameworks, not pre-trained model knowledge on benchmarks. It is a security red-teaming study testing defenses rather than model capability."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests attack/defense effectiveness rather than evaluating a pre-trained model's capability on any benchmark. The custom-constructed attack webpages are not knowledge benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests attack/defense effectiveness of web agent frameworks against social engineering, not model knowledge. Benchmark contamination in the traditional sense is not applicable."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in this study. All evaluation is conducted with automated web agent frameworks."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper includes an Ethics Considerations section addressing experimental safeguards and responsible disclosure but no IRB approval is needed."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only relative runtime overhead is reported (7.7% for SUPERVISOR, Figure 9). No absolute wall-clock times, API costs, dollar amounts, or tokens consumed per task are provided. Section 4.4.2 mentions '1.8× higher latency' for real-world pages but gives no absolute times."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total compute budget, GPU hours, or API spend is stated despite running 500 attack tasks × 5 agents, defense evaluations across multiple frameworks, real-world tests, and ablation studies — all involving multiple GPT-4o API calls."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of random seeds or seed sensitivity analysis. Results appear to be single-run point estimates."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state how many times each experiment was run. It is unclear whether results represent single runs or averages across multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search is discussed. SUPERVISOR's prompts and policies appear to be designed manually without systematic search, and no search budget is reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of how SUPERVISOR's configuration (prompt wording, policy thresholds) was selected. The prompts in Appendix D appear to be hand-crafted without justification of design choices or comparison of alternative configurations."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparisons (5 agents × 6 defense conditions, 5 inducement types, 4 attack objectives, multiple ablation conditions) without any multiple comparison correction."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own SUPERVISOR system against baselines. They do not acknowledge author-evaluation bias or that their re-implementations of baseline defenses may systematically underperform."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Figure 9 shows both relative runtime overhead and defense capability side by side for all defense frameworks, enabling cost-performance tradeoff analysis. SUPERVISOR achieves 78.1% defense capability at 7.7% overhead, compared to AGrail's 63.9% at higher overhead."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.4 validates the synthetic benchmark against real-world websites. The paper argues that the controlled environment provides 'faster, more stable evaluation and clear causal attribution' (Section 4.1.2) and demonstrates that 'the remaining attack success rate (Success/(Success+Refusal)) aligns with our synthetic benchmark, consistently exceeding 70%' (Section 4.4.2)."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses GPT-4o consistently across all five frameworks 'for fairness and reproducibility' (Section 4.1.1), controlling for model confound. Each framework's scaffold is evaluated independently, and results are reported per-framework (Tables 3-6). Table 8 further demonstrates SUPERVISOR's independence from the internal LLM choice."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether GPT-4o's training data includes social engineering examples or web security patterns that could influence the agent's susceptibility. The paper does not consider whether the model's prior exposure to similar attack patterns affects ASR."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup inadvertently provides cues to the agent. For example, simplified synthetic webpages might be easier for agents to detect as suspicious (or conversely, the lack of normal web complexity might reduce the agent's contextual reasoning)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 500 tasks are generated via Cartesian product with batch generation from Gemini-2.0-Flash, creating potential structural similarities across tasks. No discussion of independence between test instances."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention methods are used. The paper does not analyze whether the model has been exposed to similar attack patterns in training."
       }
     }
   },
   "claims": [
     {
       "claim": "AGENTBAIT achieves an average attack success rate of 67.5% across five mainstream web agent frameworks.",
       "evidence": "Table 3 reports ASR across all five frameworks under five consistency patterns, with per-framework averages ranging from 62.6% (Skyvern-AI) to 72.0% (LiteWebAgent). Overall average computed across all cells.",
       "supported": "strong"
     },
     {
       "claim": "SUPERVISOR reduces attack success rates by up to 78.1% on average compared to no-defense baseline.",
       "evidence": "Figure 8 shows SUPERVISOR's post-defense ASR across all five agents (11.8%-19.6%), compared to no-defense baselines (62.6%-72.0%). Relative reduction calculated consistently across frameworks.",
       "supported": "strong"
     },
     {
       "claim": "Context Integration (76.0%) and Trusted Entity (75.8%) are the most effective inducement contexts.",
       "evidence": "Table 4 reports per-framework ASR for five inducement types, with averages across frameworks. Context Integration reaches 79% on LiteWebAgent and Trusted Entity reaches 85% on Agent-E.",
       "supported": "strong"
     },
     {
       "claim": "SUPERVISOR's defense effectiveness is independent of the internal LLM model used.",
       "evidence": "Table 8 shows post-defense ASR across seven different LLMs (GPT-4 through DeepSeek-V3.1) with average ASR ranging narrowly from 16.6% to 18.2%. Chi-square consistency test yields p-values >0.95 for all frameworks.",
       "supported": "strong"
     },
     {
       "claim": "Web agents' intrinsic safety mechanisms are biased toward preventing explicit sensitive data disclosure while overlooking other attack types.",
       "evidence": "Figure 5 shows refusal rates: Sensitive Disclosure triggers 33.9%-67.7% refusals across agents, while Permission Abuse triggers only 3.1%-16.5%. Table 7 shows 72.4% of all attack failures are refusal-based.",
       "supported": "strong"
     },
     {
       "claim": "Real-world AGENTBAIT effectiveness is comparable to synthetic benchmarks, with reduced raw ASR attributable to capability limitations.",
       "evidence": "Section 4.4.2 reports an average -12.4% drop in raw ASR on 104 real-world test pages. After excluding capability-related failures (misnavigate, mismatch, misencoding), Success/(Success+Refusal) consistently exceeds 70%, aligning with synthetic results.",
       "supported": "moderate"
     },
     {
       "claim": "SUPERVISOR incurs only 7.7% average runtime overhead while preserving usability (2.7% task completion drop).",
       "evidence": "Figure 9 shows relative overhead per framework. Table 9 shows task completion rate drops from 81.7% to 79.0% (-2.7%). However, only relative overhead is reported with no absolute latency measurements.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No variance or uncertainty quantification",
       "detail": "All results are reported as point estimates without standard deviations, confidence intervals, or information about number of runs. For a benchmark with stochastic LLM outputs, this is a significant omission — the same task could yield different results across runs."
     },
     {
       "flag": "Synthetic benchmark may inflate or deflate attack effectiveness",
       "detail": "The primary benchmark uses simplified custom-built webpages generated by Gemini-2.0-Flash. While Section 4.4 validates on 104 real pages, the synthetic construction could introduce systematic biases not found in real-world social engineering. The generation prompt in Appendix B could produce stereotypical attacks."
     },
     {
       "flag": "Single base model for attack evaluation",
       "detail": "All attack evaluations use GPT-4o as the sole underlying LLM. Different models may exhibit substantially different vulnerability profiles. While Table 8 tests SUPERVISOR with multiple models, the attack evaluation itself is not varied across base models."
     },
     {
       "flag": "LLM used as evaluation judge",
       "detail": "An auxiliary LLM judge is used for detecting semantically equivalent refusals beyond lexical patterns (Section 4.3.2). This introduces evaluation noise and potential systematic bias, as the judge model may have its own blind spots about what constitutes a refusal."
     },
     {
       "flag": "No held-out test set for defense evaluation",
       "detail": "SUPERVISOR's prompts and policies appear designed on the same task set used for evaluation. Without a train/test split, reported defense effectiveness could reflect overfitting to the specific attack patterns in the benchmark."
     }
   ],
   "cited_papers": [
     {
       "title": "WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks",
       "authors": ["I. Evtimov", "A. Zharmagambetov", "A. Grattafiori", "C. Guo", "K. Chaudhuri"],
       "year": 2025,
       "relevance": "Benchmark for web agent security against prompt injection, showing 16-86% ASR — directly related to evaluating agent vulnerability."
     },
     {
       "title": "WIPI: A New Web Threat for LLM-Driven Web Agents",
       "authors": ["F. Wu", "S. Wu", "Y. Cao", "C. Xiao"],
       "year": 2024,
       "relevance": "Studies web threats against LLM-driven web agents with privacy leakage rates up to 70%, closely related to agent security."
     },
     {
       "title": "EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage",
       "authors": ["Z. Liao", "L. Mo", "C. Xu", "M. Kang"],
       "year": 2025,
       "relevance": "Demonstrates environmental injection attacks on web agents for privacy leakage, a directly related attack surface."
     },
     {
       "title": "SecAlign: Defending Against Prompt Injection with Preference Optimization",
       "authors": ["S. Chen", "A. Zharmagambetov", "S. Mahloujifar", "K. Chaudhuri", "D. Wagner", "C. Guo"],
       "year": 2024,
       "arxiv_id": "2410.05451",
       "relevance": "Defense against prompt injection using preference optimization, relevant to LLM agent safety."
     },
     {
       "title": "Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents",
       "authors": ["W. Yang", "X. Bi", "Y. Lin", "S. Chen", "J. Zhou", "X. Sun"],
       "year": 2024,
       "relevance": "Studies backdoor threats in LLM-based agents, revealing intermediate-stage triggers — related attack surface for agent security."
     },
     {
       "title": "AgentPoison: Red-Teaming LLM Agents via Poisoning Memory or Knowledge Bases",
       "authors": ["Z. Chen", "Z. Xiang", "C. Xiao", "D. Song", "B. Li"],
       "year": 2024,
       "relevance": "Demonstrates memory poisoning attacks against LLM agents with >80% success rates, directly related to agent security research."
     },
     {
       "title": "Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents",
       "authors": ["J. Kim", "W. Choi", "B. Lee"],
       "year": 2025,
       "arxiv_id": "2503.15547",
       "relevance": "Defense against privilege escalation in LLM agents through least-privilege enforcement, directly related to web agent security."
     },
     {
       "title": "IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems",
       "authors": ["Y. Wu", "F. Roesner", "T. Kohno", "N. Zhang", "U. Iqbal"],
       "year": 2025,
       "relevance": "Full-stack isolation defense for LLM-based agentic systems, used as comparison point for SUPERVISOR's lightweight approach."
     },
     {
       "title": "AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection",
       "authors": ["W. Luo", "S. Dai", "X. Liu", "S. Banerjee", "H. Sun", "M. Chen", "C. Xiao"],
       "year": 2025,
       "arxiv_id": "2502.11448",
       "relevance": "Lightweight agent guardrail defense used as a baseline — demonstrates permission-based safety checking approach for agents."
     },
     {
       "title": "ATHENA: Safe Autonomous Agents with Verbal Contrastive Learning",
       "authors": ["T. Sadhu", "A. Pesaranghader", "Y. Chen", "D. Yi"],
       "year": 2024,
       "relevance": "Defense using contrastive learning for agent safety, used as a baseline comparison for lightweight web agent protection."
     },
     {
       "title": "WebArena: A Realistic Web Environment for Building Autonomous Agents",
       "authors": ["S. Zhou", "F. F. Xu", "H. Zhu", "X. Zhou"],
       "year": 2024,
       "relevance": "Foundational realistic web environment benchmark for autonomous agents, relevant to web agent evaluation methodology."
     },
     {
       "title": "Generative Agents: Interactive Simulacra of Human Behavior",
       "authors": ["J. S. Park", "J. O'Brien", "C. J. Cai"],
       "year": 2023,
       "relevance": "Foundational work on generative agents that rely on prior interaction history, cited for context consistency exploitation mechanism."
     },
     {
       "title": "Investigating the Impact of Dark Patterns on LLM-Based Web Agents",
       "authors": ["D. Ersoy", "B. Lee", "A. Shreekumar", "A. Arunasalam"],
       "year": 2025,
       "arxiv_id": "2510.18113",
       "relevance": "Studies how deceptive webpage elements influence web agents, closely related work that AGENTBAIT extends with formal framework and systematic defense."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "SUPERVISOR is a pluggable defense module for deployed web automation agents, with integration demonstrated across five real frameworks and minimal overhead."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "That LLM agents are susceptible to social engineering is somewhat expected; the 67.5% average ASR and the specific authority trust bias findings are notable but not contrarian."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates that a single crafted webpage can induce credential leakage, permission abuse, or malware installation across thousands of automated agent operations — a novel and alarming attack surface."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Exposes that safety prompts in popular frameworks like Browser Use are ineffective, but framed constructively with a defense solution rather than confrontationally."
     },
     "demo_ability": {
       "score": 2,
       "justification": "An anonymous repository link is provided with code and sanitized attack tasks, but it is not a pip-installable tool or live demo."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From Fudan University and Tsinghua University (respected but not top AI labs in public discourse). Evaluates known open-source frameworks like Browser Use."
     }
   }
 }