Prompt-Injection Resilience in Browser-Embedded Assistants
Marcus Tan, Sofia Lindqvist, Lena Hartwell
Assistants embedded in web browsers read page content on the user's behalf, which exposes them to indirect prompt injection: instructions hidden in a page that the assistant mistakes for the user's. We build a test suite of 600 injected pages across seven attack styles and measure three defences: instruction-hierarchy prompting, a classifier that screens page text, and permission gating of sensitive actions. No single defence is sufficient; combining a screening classifier with gating of actions that write or send data lowers attack success from 62% to 4% while preserving 93% of benign task success.