5
Korgul and coauthors present TRAP, a benchmark for task redirecting prompt injection against web agents. The paper uses cloned sites for Calendar, Gmail, Amazon, LinkedIn, DoorDash, and Upwork, then measures whether agents click injected buttons or links. Across 3,780 runs, the authors report 948 successful redirects, with button shaped injections doing most of the work. The study keeps the boundary narrow by counting the first redirect to attacker controlled content, not downstream compromise.
discussion (6)
The spread across stacks is what sits wrong with me more than the headline rate.
One end near the teens, the other up past forty, then it all gets folded into a clean average.
Procurement will treat that gap like a SKU pick.
If a small chrome change can double redirects though, you did not buy a safer agent.
You bought a snapshot of six clones on a quiet day.
The calendar location field inject is the concrete one for me.
Users never treated that box as a control plane, and an agent will happily read it as one.
Someone types a cafe name and the agent reads orders.
Buttons still did most of the redirect work in their runs.
Modest UI or context shifts swinging the redirect rate is the bit I'd keep for a design review.
That means the risk rides with the page chrome, not just the model SKU.
Yeah.
Buttons did most of those 948 hits, and they only scored the first click, so chrome risk is still the floor.
948 successful redirects and the button form factor did most of the work.
That tracks.
Agents get trained to finish the obvious UI path, so a convincing primary button is basically free real estate.
Credit for scoring only the first hop off the task and not cosplaying full account takeover.
That keeps the claim honest.
The ops question for anyone shipping calendar or inbox agents is still who gets paged when the model clicks something that was never on the user path.