{"id":"https://openalex.org/W7151060071","doi":"https://doi.org/10.48550/arxiv.2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","display_name":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","publication_year":2026,"publication_date":"2026-04-03","ids":{"openalex":"https://openalex.org/W7151060071","doi":"https://doi.org/10.48550/arxiv.2604.02623"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.02623","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02623","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.02623","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133052057","display_name":"Wei Zou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zou, Wei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133047362","display_name":"Mingwen Dong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dong, Mingwen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008600285","display_name":"Miguel Romero Calvo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Calvo, Miguel Romero","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015849999","display_name":"Shuaichen Chang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chang, Shuaichen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139818188","display_name":"Jiang Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Jiang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100643556","display_name":"Dongkyu Lee","orcid":"https://orcid.org/0000-0002-1318-6276"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lee, Dongkyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133055358","display_name":"Xing Niu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Niu, Xing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133004202","display_name":"Xiaofei Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Xiaofei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133042793","display_name":"Yanjun Qi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Qi, Yanjun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5127101963","display_name":"J Jiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Jiarong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.23440000414848328,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.23440000414848328,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.20270000398159027,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.12639999389648438,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8446999788284302},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5430999994277954},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5299999713897705},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3889000117778778},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.37540000677108765},{"id":"https://openalex.org/keywords/memory-protection","display_name":"Memory protection","score":0.3425999879837036}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8446999788284302},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7239999771118164},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6848999857902527},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5430999994277954},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5299999713897705},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3889000117778778},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.37540000677108765},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.35569998621940613},{"id":"https://openalex.org/C18131444","wikidata":"https://www.wikidata.org/wiki/Q163585","display_name":"Memory protection","level":5,"score":0.3425999879837036},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.33410000801086426},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C90673727","wikidata":"https://www.wikidata.org/wiki/Q901718","display_name":"Product (mathematics)","level":2,"score":0.28519999980926514},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.273499995470047},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.25380000472068787}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.02623","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02623","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.02623","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.02623","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.6732152104377747,"id":"https://metadata.un.org/sdg/15","display_name":"Life in Land"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Memory":[0,66],"makes":[1],"LLM-based":[2],"web":[3],"agents":[4,17,140,156],"personalized,":[5],"powerful,":[6],"yet":[7],"exploitable.":[8],"By":[9],"storing":[10],"past":[11],"interactions":[12],"to":[13,72,124,152],"personalize":[14],"future":[15,100],"tasks,":[16],"inadvertently":[18],"create":[19],"a":[20,51,88],"persistent":[21],"attack":[22,71,120],"surface":[23],"that":[24],"spans":[25],"websites":[26],"and":[27,97,131,190],"sessions.":[28],"While":[29],"existing":[30],"security":[31],"research":[32],"on":[33,102,110,126,129,133],"memory":[34,41,46,80,96,203],"assumes":[35],"attackers":[36],"can":[37],"directly":[38],"inject":[39],"into":[40],"storage":[42],"or":[43,161],"exploit":[44],"shared":[45],"across":[47],"users,":[48],"we":[49,136],"present":[50],"more":[52,146,165,170],"realistic":[53],"threat":[54],"model:":[55],"contamination":[56],"through":[57],"environmental":[58,142],"observation":[59,85],"alone.":[60],"We":[61],"introduce":[62],"Environment-injected":[63],"Trajectory-based":[64],"Agent":[65],"Poisoning":[67],"(eTAMP),":[68],"the":[69,181,196],"first":[70],"achieve":[73],"cross-session,":[74],"cross-site":[75],"compromise":[76],"without":[77],"requiring":[78],"direct":[79],"access.":[81],"A":[82],"single":[83],"contaminated":[84],"(e.g.,":[86],"viewing":[87],"manipulated":[89],"product":[90],"page)":[91],"silently":[92],"poisons":[93],"an":[94],"agent's":[95],"activates":[98],"during":[99],"tasks":[101],"different":[103],"websites,":[104],"bypassing":[105],"permission-based":[106],"defenses.":[107],"Our":[108],"experiments":[109],"(Visual)WebArena":[111],"reveal":[112],"two":[113],"key":[114],"findings.":[115],"First,":[116],"eTAMP":[117],"achieves":[118],"substantial":[119,174],"success":[121],"rates:":[122],"up":[123,151],"32.5%":[125],"GPT-5-mini,":[127],"23.4%":[128],"GPT-5.2,":[130],"19.5%":[132],"GPT-OSS-120B.":[134],"Second,":[135],"discover":[137],"Frustration":[138],"Exploitation:":[139],"under":[141],"stress":[143],"become":[144],"dramatically":[145],"susceptible,":[147],"with":[148,158],"ASR":[149],"increasing":[150],"8":[153],"times":[154],"when":[155],"struggle":[157],"dropped":[159],"clicks":[160],"garbled":[162],"text.":[163],"Notably,":[164],"capable":[166],"models":[167],"are":[168],"not":[169],"secure.":[171],"GPT-5.2":[172],"shows":[173],"vulnerability":[175],"despite":[176],"superior":[177],"task":[178],"performance.":[179],"With":[180],"rise":[182],"of":[183],"AI":[184],"browsers":[185],"like":[186],"OpenClaw,":[187],"ChatGPT":[188],"Atlas,":[189],"Perplexity":[191],"Comet,":[192],"our":[193],"findings":[194],"underscore":[195],"urgent":[197],"need":[198],"for":[199],"defenses":[200],"against":[201],"environment-injected":[202],"poisoning.":[204]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-04-07T00:00:00"}