---
title: "Untrusted Content Masking for Web Agents with Security Guarantees"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05277v1"
permalink: "https://feed.astralor.com/items/itm_cd6bafc3954ab8a87752ed71"
published: "2026-07-06T16:22:37.000Z"
score: 81
channel: "ai"
tags: ["Web Agent","UCM","Prompt Injection","DOM"]
---

# Untrusted Content Masking for Web Agents with Security Guarantees

## AI commentary

> This paper hits the exact pain point of secure web agent deployment with a simple yet elegant solution. It's a must-read for any team building or using web agents, showing how to maintain perception and interaction without compromising security.

## At a glance

This paper proposes Untrusted Content Masking (UCM), a defense against prompt injection attacks for web agents. The key insight is that a webpage's Document Object Model (DOM) encodes enough information to distinguish trusted from untrusted regions without reading content. UCM restores the trust boundary by redacting untrusted regions before they reach the agent and routing interactions through a sandboxed interface, enabling secure perception and interaction. The code is open-sourced. This simple yet effective approach offers a practical path toward provably secure web agent deployment.

## Key points

- Proposes UCM that leverages DOM structure to distinguish trusted from untrusted regions without content analysis.
- Restores trust boundary by redacting untrusted content and routing interactions via a sandbox.
- Provides provable security guarantees for web agents, addressing the failure due to structural entanglement.
- Open-sourced code for easy reproduction and adoption.

## Full text

Defenses that provide security guarantees against prompt injection attacks rely on strict isolation between trusted instructions and untrusted data. In text-based environments such as tool-use APIs, this separation arises naturally: agents can reason from interface definitions without ever processing untrusted content. Extending these guarantees to web agents faces a fundamental challenge: to perceive and interact with their environment, web agents must first observe the rendered page, which intermingles trusted content with untrusted content. This structural entanglement removes the trust boundary on which security guarantees depend, undermining provable defenses for web agents. In this paper, we present Untrusted Content Masking (UCM), a simple and effective approach that restores this boundary in web environments. We leverage a key structural insight: a webpage's Document Object Model (DOM) encodes sufficient information to distinguish trusted from untrusted regions without reading their content. Our framework exploits this by redacting untrusted regions before they reach the agent and routing interaction through a sandboxed interface with strict privilege separation, thereby enabling agents to observe and interact with their environment while remaining isolated from adversarial content. The code is publicly available.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_cd6bafc3954ab8a87752ed71