Updated 7/21/2026
The paper defines Cross-Site Prompting (XSP): attacker-controlled text in reviews, posts, seller listings, advertisements, or embeds can be interpreted as instructions by a web agent and steer its browser actions. It evaluates three reproducible WebArena attack templates—Shortcut, Fake Completion, and Ignore Instruction—plus WASP and adaptive stress tests. This is an evaluated agent-security issue and mitigation, not a claimed production CVE.
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Affects: GPT-5.4, GPT-5.4-mini, GPT-5.4 Nano +4 more
Source: arXiv