The paper demonstrates that LLM-based browser agents can be identified by passive JavaScript tracking of their UI actions and timings, achieving up to 96% F1 within a single harness and 0.74–0.81 Macro‑F1 when pooling across harnesses. Identification is possible with only about one‑third of the traces and improves as more events are observed. Randomised timing delays reduce but do not eliminate classifier performance, and retraining on delayed data largely restores accuracy.
arXiv:2606.20910v2 Announce Type: replace-cross Abstract: As AI web agents proliferate, combining large language models with autonomous, browser-level control, indiscriminate content scraping by web...
arXiv:2604. 06367v2 Announce Type: replace-cross Abstract: Web agents automate browser tasks, ranging from simple form completion to complex workflows like ordering groceries.
arXiv:2602. 09222v2 Announce Type: replace-cross Abstract: Large language model (LLM) based web agents are increasingly deployed to automate complex online tasks by directly interacting with web sites and performing actions on users' behalf.
The paper investigates how tool-call traces from large language model agents can reveal user attributes. Using the PrivacyTrace benchmark, the authors show that an attacker can infer user profiles with a 26.25% success rate from tool-call data, outperforming prior guessing methods. The study highlights that tool arguments and results are key evidence, and linking traces across sessions increases profiling risk.
arXiv:2511. 20597v2 Announce Type: replace-cross Abstract: The integration of artificial intelligence (AI) agents into web browsers introduces security challenges that go beyond traditional web application threat models.
The paper introduces a method to detect which web scrapers feed data to large language models (LLMs) by deploying dynamic websites that issue unique canary tokens to each scraper. By querying LLMs for information about these sites, the authors can identify when an LLM consistently outputs the unique tokens, indicating exposure to a specific scraper. Experiments on 22 production LLM systems show the technique reliably uncovers both known and undisclosed scrapers, offering a tool for third parties to monitor and control unwanted web scraping.
arXiv:2602. 06547v4 Announce Type: replace-cross Abstract: LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges.
arXiv:2606. 14027v1 Announce Type: cross Abstract: Agentic browsers integrate autonomous AI agents into web browsers, enabling users to accomplish web tasks through natural-language instructions.
The paper presents methods for black-box forensic analysis of conversational large language model (LLM) agents, focusing on two tasks: attribution—identifying the base model powering a chatbot—and fingerprinting—detecting identical system prompts across different endpoints. Attribution classifiers achieve 98% accuracy using only a few non‑adversarial conversation turns, while a cross‑encoder fingerprinting approach attains an AUC of 0.768 and an F1 of 0.703 on unseen prompts, improving to 0.943 AUC when aggregating 50 interactions. These techniques enable investigators to trace AI‑enabled scams back to their underlying models and link related scams through shared system prompts.
The paper introduces ANGLER, an adaptive framework that uses state-based verifiers from the REEF benchmark to guide the evolution of web‑agent attacks. REEF provides 9 verifier‑grounded websites and 5 attack types, enabling realistic red‑teaming of VLM‑based agents. ANGLER improves attack success rates to 20.36% versus 15.24% for non‑adaptive methods and lowers benign task success from 61.9% to 44.4%.
arXiv:2602. 06547v3 Announce Type: replace-cross Abstract: LLM-based coding agents increasingly rely on third-party extensions called skills, which bundle natural language instructions and helper scripts that execute with full user privileges.
arXiv:2606. 16100v1 Announce Type: cross Abstract: As Large Language Model (LLM) APIs become ubiquitous, users increasingly rely on black-box fingerprinting to verify that providers are serving the advertised premium models.