PIP-006
Indirect injection through web content
A page the assistant browses carries instructions, which are read with the user's authenticated session available.
How it works
Browsing agents read pages and act on them, so any page in reach becomes an instruction channel. The browser was designed to render untrusted content, not to execute it with the user's authority; an agent collapses that distinction.
Why it works
The agent operates inside the user's trust boundary, behind authentication, and the payload is ordinary page content that no malware filter is looking for.
What it looks like
Instructions embedded in page text, frequently rendered invisible to a human reader while remaining fully legible to whatever is parsing the page.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Withhold authenticated sessions from browsing agents
Architectural
Deny agents access to sessions for finance, email and administrative surfaces until a vendor can demonstrate genuine separation between page content and instruction context.
Per-task least-privilege credentials
Architectural
Prefer deployments where the agent holds narrow, short-lived credentials for the task at hand rather than inheriting the user's full session.
Monitor agent navigation
Raises cost
An agent that navigates to an unfamiliar domain in the middle of a task is a signal worth alerting on, and it is one of the few detections that works after the fact.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051.001 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.