[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82928-en":3,"doc-seo-82928-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},82928,8796095461610,"Oliver","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","Untrusted Content Masking for Web Agents with Security Guarantees","Untrusted Content Masking (UCM) restores the trust boundary required for provable prompt-injection defenses in web agents. Web agents must observe rendered pages where trusted and untrusted content are entangled, breaking formal isolation assumptions. UCM uses the DOM to distinguish regions without reading their content, redacts untrusted areas into labeled placeholders, and routes sensitive queries through a sandboxed quarantined model that returns only structured, type-restricted outputs. The result blocks adversarial instructions while preserving task utility.","Untrusted Content Masking for Web Agents with  \nSecurity Guarantees  \narXiv :2607 .05277v 1 [ cs .CR] 6 Jul 2026  \nKristina Nikoli∗ ETH Zurich  \nETH AI Center  \nMatthew Jagielski  \nAnthropic  \nEgor Zverev∗ Javier Rando  \nISTA Anthropic  \nETH Zurich  \nEdoardo Debenedetti  \nETH Zurich  \nFlorian Tramèr  \nETH Zurich  \nAbstract  \nDefenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which intermingles trusted content with untrusted content. This structural entanglement removes the trust boundary on which security guarantees depend, undermining provable defenses for web agents. In this paper, we present Untrusted Content Masking (UCM), a simple and effective approach that restores this boundary in web environments. We leverage a key structural insight: a webpage’s Document Object Model (DOM) encodes sufficient information to distinguish trusted from untrusted regions without reading their content. Our framework exploits this by redacting untrusted regions before they reach the agent and routing interaction through a sandboxed interface with strict privilege separation, thereby enabling agents to observe and interact with their environment while remaining isolated from adversarial content. The code is publicly available2.  \n1 Introduction  \nWeb agents that autonomously browse and interact with websites are transitioning rapidly from prototypes to production. Systems such as Claude Computer Use [Anthropic, 2024], OpenAI Operator [OpenAI, 2025], and UI-TARS [Qin et al., 2025] can now book flights, manage calendars, and navigate complex web applications on behalf of users. However, this autonomy introduces a critical security risk: web agents are highly susceptible to prompt injection attacks, where adversarial content embedded in webpages manipulates agent behavior [Kuntz et al., 2025] .  \nPrompt injection is particularly problematic in web environments because agents routinely encounter untrusted content—user comments, product reviews, forum posts, and advertisements—that may contain malicious instructions. Existing defenses fall into two categories. Heuristic defenses improve robustness but provide no formal guarantees and can be circumvented by adaptive attacks [Nasr et al., 2025] . Guaranteed defenses enforce deterministic isolation between planning and data processing, but severely constrain utility by preventing the agent from observing page content directly. Recent work on single-shot planning [Foerster et al., 2026] offers control-flow integrity guarantees, but  \n∗Equal contribution.  \n2 The code is available at [https://github.com/ethz-spylab/untrusted-content-masking](https://github.com/ethz-spylab/untrusted-content-masking)  \nPreprint.  \nFigure 1: Overview ofUntrusted Content Masking (UCM) defense. Untrusted webpage content is masked with labeled placeholders, preventing prompt injection attacks from being shown to the Agent. The Agent queries a Quarantined Model (Q-Model) by providing an element ID, a question, and a return type; the Q-Model reads the actual hidden content and returns a structured response, enabling safe reasoning about untrusted elements without direct exposure.  \nwithout a mechanism to separate trusted from untrusted content on the rendered page, the planner must be kept entirely blind to the environment, limiting flexibility. Piet et al. [2026] propose planning over typed, trusted website APIs, but constructing and maintaining these demands significant per-site infrastructure and moves away from natural web interaction.  \nWe propose Untrusted Content Masking (UCM), a defense ","cbCailhJbRPT5Ca0","https://ap.wps.com/l/cbCailhJbRPT5Ca0","pdf",1948351,2,1,28,"English","en",105,"# Introduction\n## Security challenge of prompt injection in web agents\n## Existing defense approaches and limitations\n## Untrusted Content Masking (UCM) approach\n## Contributions and evaluation","[{\"question\":\"为什么传统基于文本隔离的安全保证在 Web 代理中难以直接复用？\",\"answer\":\"因为 Web 代理必须先观察渲染页面，而渲染结果会把受信内容与不受信内容混在一起，破坏了安全保证依赖的信任边界。\"},{\"question\":\"UCM 如何利用 DOM 来恢复信任边界？\",\"answer\":\"UCM 利用网页的 DOM 结构信息区分受信与不受信区域，而不需要直接读取不受信内容本身。之后在页面渲染给代理之前将不受信区域替换为带标签的占位符。\"},{\"question\":\"当任务确实需要读取不受信内容时，UCM 如何保证不会注入恶意指令？\",\"answer\":\"代理不直接读取不受信文本，而是向隔离的 Quarantined Model 查询；该模型只返回受限的结构化结果（例如布尔值、整数、枚举、日期、浮点等），从而避免不受信信息携带注入式指令。\"}]",1784184031,71,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"untrusted-content-masking-for-web-agents-with-security-guarantees","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,47,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":20},"https://docshare.wps.com/document/","Document",{"item":48,"name":12,"@type":43,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/untrusted-content-masking-for-web-agents-with-security-guarantees/82928/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-20","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"为什么传统基于文本隔离的安全保证在 Web 代理中难以直接复用？","Question",{"text":75,"@type":76},"因为 Web 代理必须先观察渲染页面，而渲染结果会把受信内容与不受信内容混在一起，破坏了安全保证依赖的信任边界。","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"UCM 如何利用 DOM 来恢复信任边界？",{"text":80,"@type":76},"UCM 利用网页的 DOM 结构信息区分受信与不受信区域，而不需要直接读取不受信内容本身。之后在页面渲染给代理之前将不受信区域替换为带标签的占位符。",{"name":82,"@type":73,"acceptedAnswer":83},"当任务确实需要读取不受信内容时，UCM 如何保证不会注入恶意指令？",{"text":84,"@type":76},"代理不直接读取不受信文本，而是向隔离的 Quarantined Model 查询；该模型只返回受限的结构化结果（例如布尔值、整数、枚举、日期、浮点等），从而避免不受信信息携带注入式指令。","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]