Harness Matters: Measuring and Dissecting Security Resilience in Web Agents
Xinyi Wu, Jiagui Chen and colleagues at Fudan University build WebTrap Farm to measure how much a web agent's harness, separately from its backend model, determines its security.
Ask this paper
Framework. Harnesses are modeled as four stages (goal interpretation, page perception, planning, action execution) and tested against malicious user prompts, prompt injection and deceptive web design, with webpage instrumentation for cross-harness runs.
Capability control. Paired usability calibration tasks separate a real defense from an agent that simply could not finish the task, which earlier benchmarks often counted as a defense.
Findings. Existing open-source and commercial web-agent harnesses stay vulnerable to typical attacks, and some unsafe actions occur with no attack content at all. Both harness and backend model significantly affect security outcomes.
Guidance. Stage-level analysis locates where defensive behavior emerges and identifies harness design mechanisms that improve security.
Abstract
Web agents extend LLMs from text generation to real-world web interaction by relying on execution harnesses that interpret user goals, perceive webpages, plan actions, and ground model decisions into browser operations. While prior work has recognized that agent security depends on more than the backend model alone, how harness design quantitatively shapes web-agent security remains insufficiently measured. To systematically study web-agent harness security, we first characterize web-agent harnesses as a four-stage execution workflow covering goal interpretation, webpage perception, reasoning and planning, and action execution. Based on this abstraction, we build WebTrap Farm, a systematic and extensible evaluation framework covering three representative attack categories: malicious user prompts, malicious prompt injection, and deceptive web design. To avoid conflating security with task capability, we use paired usability calibration tasks to separate genuine defensive behavior from capability limitations. Our evaluation shows that existing web-agent harnesses remain vulnerable to typical attacks, with some unsafe behaviors occurring even without explicit attack content, revealing harness-intrinsic security failures (RQ1). Statistical analysis further shows that both harness and backend model significantly affect security outcomes, indicating that deployed-agent security is jointly shaped by the harness and backend model (RQ2). Finally, we localize where defensive behavior emerges across workflow stages and identify more secure design mechanisms, providing actionable guidance for building more robust web agents (RQ3). These findings highlight the web-agent harness as an important security boundary and motivate moving beyond model-centric defenses toward harness-level security design.