The Flow has not summarised this story yet — read it at arXiv Computation and Language.
MIRAGE is a visual indirect prompt injection framework that targets multimodal large language model (MLLM)-based web agents. It operates under realistic constraints where an attacker controls only a semantically legitimate, spatially confined region such as an ad slot or widget. Using diffusion models and a robust optimization technique, MIRAGE generates perceptually benign adversarial images confined to the attacker’s boundaries, enabling next‑action hijacking while remaining stealthy.
arXiv:2608. 08392v1 Announce Type: new Abstract: Large language models are increasingly deployed as autonomous agents that interact with the web through browsers.
arXiv:2603.04364v2 Announce Type: replace-cross Abstract: Multimodal web agents that process both screenshots and accessibility trees are increasingly deployed to interact with web interfaces, yet th...
arXiv:2505. 14289v2 Announce Type: replace Abstract: Graphical User Interface (GUI) agents powered by Multimodal Large Language Models (MLLMs) are increasingly deployed yet vulnerable to Environmental Injection Attacks (EIAs).
arXiv:2509.11250v3 Announce Type: replace-cross Abstract: Graphical User Interface (GUI) agents are increasingly deployed to interact with online web services, yet their exposure to open-world conten...
The paper introduces an end‑to‑end framework for testing image‑triggered command injection on computer‑use agents (CUAs). It demonstrates that a local visual patch can cause verifiable environmental effects through the entire pipeline—from screenshot input, through vision‑language‑model generation, action parsing, to execution—by training and deploying patches on GitHub Pages and a CSDN clone. Across five open‑source or publicly available GUI‑agent or VLM backends, the study reports 84.5% T‑ASR, 47.0% TAPR, and 20.3% E2E‑ASR success rates, with trajectory analysis revealing that some attacks first execute malicious terminal commands before continuing the original task.