Web Agents Leak Sensitive Data on Simple Scalable Websites

Recent work has shown that web browsing agents are vulnerable to malicious online content. These agents can operate on the open Internet with limited supervision and often have access to sensitive user data. In this work, we show that attacker-owned websites can induce data exfiltration from web agents with simple web design (no prompt injections, hidden text, dark patterns, or environment injections). We propose a framework for generating sandboxed malicious sites across hundreds of page archetypes and visual styles implementing thirty exfiltration vectors, and we test generated sites against twelve recent LLMs with three web agent scaffolds. Our scalable framework can generate thousands of such sites in hours, creating a large benchmark for evaluating web agent safety. We find that these sites can elicit data exfiltration in frontier web agents even when those agents are explicitly prompted not to share sensitive data. We further show that these sites are difficult to detect with guardrail classifiers. Our findings illustrate the challenges of securing web agents and the importance of developing large-scale evaluations to stress test against data exfiltration.