任务重定向智能体诱导基准：面向网络智能体的评估框架 (It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents)

Web-based agents powered by large language models are increasingly used for tasks such as email management or professional networking. Their reliance on dynamic web content, however, makes them vulnerable to prompt injection attacks: adversarial instructions hidden in interface elements that persuade the agent to divert from its original task. We introduce the Task-Redirecting Agent Persuasion Benchmark (TRAP), an evaluation for studying how persuasion techniques misguide autonomous web agents on realistic tasks. Across six frontier models, agents are susceptible to prompt injection in 25\% of tasks on average (13\% for GPT-5 to 43\% for DeepSeek-R1), with small interface or contextual changes often doubling success rates and revealing systemic, psychologically driven vulnerabilities in web-based agents. We also provide a modular social-engineering injection framework with controlled experiments on high-fidelity website clones, allowing for further benchmark expansion.

翻译：基于大语言模型的网络智能体在电子邮件管理和专业社交等任务中的应用日益广泛。然而，其对动态网络内容的依赖使其易受提示注入攻击的影响：攻击者可通过界面元素中隐藏的对抗性指令诱导智能体偏离原始任务。本文提出任务重定向智能体诱导基准（TRAP），该评估框架旨在研究诱导技术如何在现实任务中误导自主网络智能体。在六种前沿模型的测试中，智能体平均在25%的任务中受到提示注入影响（GPT-5为13%，DeepSeek-R1为43%），微小的界面或上下文调整常使成功率翻倍，揭示了网络智能体存在系统性、受心理机制驱动的安全漏洞。我们还开发了模块化的社会工程学注入框架，通过高保真网站克隆进行受控实验，为基准的后续扩展提供了技术支持。