Sample record. This work is fictional demonstration content. Results, people and institutions are placeholders; references in full-text articles are real publications.
Highlights
- 600-page test suite covering seven indirect prompt-injection styles.
- Combining screening with permission gating lowers attack success from 62% to 4%.
- Benign task success is preserved at 93%.
Abstract
Assistants embedded in web browsers read page content on the user's behalf, which exposes them to indirect prompt injection: instructions hidden in a page that the assistant mistakes for the user's. We build a test suite of 600 injected pages across seven attack styles and measure three defences: instruction-hierarchy prompting, a classifier that screens page text, and permission gating of sensitive actions. No single defence is sufficient; combining a screening classifier with gating of actions that write or send data lowers attack success from 62% to 4% while preserving 93% of benign task success.
Keywords prompt injection · browser assistants · security · permission gating
1.Introduction
When a browser assistant summarises a page or fills a form, the page itself becomes an input channel. Attackers can embed text that tells the assistant to exfiltrate data or take actions the user never requested [1, 2]. We evaluate defences in a controlled setting that mirrors realistic browsing tasks.
2.Threat model and defences
The attacker controls page content but not the user's instructions or the assistant. Success means the assistant performs an attacker-specified action. We compare three defences:
- Instruction hierarchy — the prompt marks page content as untrusted data.
- Screening — a classifier flags page text that looks like instructions.
- Gating — actions that send or write data require explicit user confirmation.
3.Results
Table 1 reports attack success and benign task success for each defence and combination. Gating is the most effective single defence, since it does not depend on recognising the attack, but it reduces usability when applied to every action.
| Defence | Attack success ↓ | Benign success ↑ |
|---|---|---|
| None | 62 | 97 |
| Instruction hierarchy | 41 | 96 |
| Screening classifier | 23 | 95 |
| Action gating | 11 | 90 |
| Screening + gating | 4 | 93 |
Residual risk
Attacks that induce the user to confirm a gated action remain possible. Interface design for confirmations is an open problem.
Declarations
- Author contributions
- M.T. designed the suite and defences; S.L. contributed the threat model; L.H. contributed to writing.
- Funding
- Sample article – no funding to declare.
- Competing interests
- The authors declare no competing interests.
- Data and code availability
- Sample article. All results, names and affiliations in this demonstration article are synthetic placeholders.
References
- [1]Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., Fritz, M. (2023). Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. arXiv:2302.12173
- [2]Perez, F., Ribeiro, I. (2022). Ignore previous prompt: Attack techniques for language models. arXiv preprint. arXiv:2211.09527
Versions
Version 1 · 2 October 2026Latest
First version.
10.xxxx/ctm.pp.2026.0006.v1
How to cite
Tan, M., Lindqvist, S., & Hartwell, L. (2026). Prompt-Injection Resilience in Browser-Embedded Assistants [Preprint, version 1]. CONTINUUM Preprints. doi:10.xxxx/ctm.pp.2026.0006
© 2026 The authors. Published by AEX CONTINUUM under the CC BY 4.0 licence.