The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation

The paper examines how AI agents that interact directly with web service backends alter the exploitation of existing web vulnerabilities. Using the VELA benchmark, which includes 44 vulnerabilities across twelve application families, the authors evaluate three commercial agents and find that exploitability is largely determined by the interface design rather than the agent itself, with 91% of vulnerabilities remaining exploitable under the reference configuration. Interface restrictions can reduce attack success, yet the agents generally do not introduce new failures, and in some cases even complete attacks that users omitted.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

• agents
• benchmarks