LoginTrap: Phishing-Style Indirect Prompt Injection Inducing Web Agent Logins
First seen Aug 6, 2026 · Updated Aug 6, 2026
Researchers demonstrate LoginTrap, an indirect prompt injection technique that manipulates LLM-based web agents into believing login is a necessary step to complete a task, redirecting them to attacker-controlled login pages. This exploits the authentication boundary of web agents to potentially exfiltrate user credentials, achieving an 86% average success rate across multiple LLM backbones and agent architectures. This is a research disclosure, not an observed active exploit, but it demonstrates a credible and highly effective attack surface.
Technical Analysis
The attack embeds page-specific indirect prompt injection content into webpages that web agents visit while performing autonomous tasks; a fuzzing-inspired generation process crafts context that convincingly frames login as a plausible prerequisite for task continuation. The attacker operates in a black-box model, controlling only webpage content and the induced login flow, without needing knowledge of the user's task or the underlying agent architecture/model. Because web agents interpret webpage content as part of their operating context (mixing untrusted data with instructions), the injected content hijacks the agent's plan and steers it toward attacker-controlled login pages, crossing the boundary between passive content observation and privileged credential-entry action. The attacker's gain is potential capture of user credentials or sensitive authentication data, effectively turning the agent into an unwitting proxy for credential exfiltration; the technique remains effective across different LLM backbones, agent architectures, and existing defenses.
Affected Systems
generic LLM-based web agent frameworks (browser-automation agents)
Detection Signatures
- Webpage content containing unsolicited login prompts unrelated to the user's original task intent
- DOM elements or injected text framing login as a 'required step' or 'prerequisite' inserted mid-task
- Agent navigation logs showing unexpected redirection to login/credential-entry pages not part of original task plan
- High-frequency A/B variations of login-inducing phrasing across pages (fuzzing artifacts)
- Agent action traces where login attempts occur on domains not matching the original task's target site
Remediation Steps
- 1
Authentication-aware action gating
Require explicit user confirmation or out-of-band approval before a web agent submits credentials or navigates to any login page, especially domains differing from the original task target.
- 2
Content-instruction separation
Architect agents to treat webpage text as untrusted data, not as instructions; use structured extraction and instruction-filtering layers to strip imperative or task-redirecting language from observed page content.
- 3
Domain allow-listing for credential entry
Restrict agents to only perform login/credential-submission actions on pre-approved, user-verified domains associated with the original task.
- 4
Task-goal consistency checks
Implement a planner-level check that flags and halts execution when a proposed action (e.g., login) is not a coherent, previously anticipated step of the user's original task.
- 5
Red-team with fuzzing-style injection testing
Proactively test agents against fuzzing-generated indirect injection payloads (like LoginTrap) across diverse page contexts and agent backbones before deployment.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.