It’s a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents

Karolina Korgul, Yushi Yang, Arkadiusz Drohomirecki, Piotr Blaszczyk, Will Howard, Lukas Aichberger, Chris Russell, Philip Torr, Adam Mahdi, Adel Bibi
Proceedings of the 43rd International Conference on Machine Learning, PMLR 306:60284-60300, 2026.

Abstract

Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), a benchmark for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25% of tasks on average (13% for GPT-5 to 43% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion.

Cite this Paper

BibTeX
@InProceedings{pmlr-v306-korgul26a, title = {It’s a {TRAP}! {T}ask-Redirecting Agent Persuasion Benchmark for Web Agents}, author = {Korgul, Karolina and Yang, Yushi and Drohomirecki, Arkadiusz and Blaszczyk, Piotr and Howard, Will and Aichberger, Lukas and Russell, Chris and Torr, Philip and Mahdi, Adam and Bibi, Adel}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, pages = {60284--60300}, year = {2026}, editor = {Zhang, Tong and Dudik, Miroslav and Jaggi, Martin and Agarwal, Alekh and Li, Sharon and Schuurmans, Dale and Zhu, Jerry and Berkenkamp, Felix and Dong, Hanze and Bietti, Alberto}, volume = {306}, series = {Proceedings of Machine Learning Research}, month = {06--11 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v306/main/assets/korgul26a/korgul26a.pdf}, url = {https://proceedings.mlr.press/v306/korgul26a.html}, abstract = {Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), a benchmark for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25% of tasks on average (13% for GPT-5 to 43% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion.} }
Endnote
%0 Conference Paper %T It’s a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents %A Karolina Korgul %A Yushi Yang %A Arkadiusz Drohomirecki %A Piotr Blaszczyk %A Will Howard %A Lukas Aichberger %A Chris Russell %A Philip Torr %A Adam Mahdi %A Adel Bibi %B Proceedings of the 43rd International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2026 %E Tong Zhang %E Miroslav Dudik %E Martin Jaggi %E Alekh Agarwal %E Sharon Li %E Dale Schuurmans %E Jerry Zhu %E Felix Berkenkamp %E Hanze Dong %E Alberto Bietti %F pmlr-v306-korgul26a %I PMLR %P 60284--60300 %U https://proceedings.mlr.press/v306/korgul26a.html %V 306 %X Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), a benchmark for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25% of tasks on average (13% for GPT-5 to 43% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion.
APA
Korgul, K., Yang, Y., Drohomirecki, A., Blaszczyk, P., Howard, W., Aichberger, L., Russell, C., Torr, P., Mahdi, A. & Bibi, A.. (2026). It’s a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents. Proceedings of the 43rd International Conference on Machine Learning, in Proceedings of Machine Learning Research 306:60284-60300 Available from https://proceedings.mlr.press/v306/korgul26a.html.

Related Material