What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics

What It Is, Not What It Says. Securing Agentic Browsing Interactions with Web Semantics. By Umar Iqbal, from Washington University in St. Louis. Published on the fifteenth of October. Its code repository is worked out: about seventy-five source files, with a readme and a licence.

AI agents increasingly browse the web on their users' behalf, and they take in webpages as screenshots or as text. That exposes their language models to unvetted third-party content. Browsers already enforce a set of semantics for this: what an element on a page can do depends on what it is and where it comes from, not on what it says. Agents flatten those semantics. Once a page is reduced to text, injected words can persuade the model to exercise the user's authority on behalf of content that has no authority at all. And since LLMs remain easy to persuade, hoping the model will resist is not enough.

The argument is that the agent's interface to the web must itself guarantee the integrity of what the agent reads, interprets and does. Intact is built on that principle, and it runs on an unmodified browser. Rather than trusting the model to sort honest content from injected content, it restores the browser's own semantics around the model, so that an element's power comes from what it is and where it came from.

Intact builds GenTree, a bespoke representation of the page that captures provenance and web semantics. It then passes the page to the LLM through GenTree one element at a time, so the model decides about each element without seeing any other element's text. Injected text in one place therefore cannot steer a decision about another. The harness around the model executes each step only within the capabilities of that step's element, and it asks the user before acting on third-party content.

Provenance comes first. Across one thousand two hundred and seventy real webpages, GenTree attributes two point three times as many elements to third parties as the browser does, and the browser misattributes fifty-eight point seven percent of those to the first party.

Then attacks. On one thousand and ninety-one of those pages with injected attacks, only twelve point eight percent of attacks get through Intact's planner, and each of those surfaces at most as a consent request to the user. A conventional planner lets through seventy-three point one percent. The isolation has a cost: it disrupts functionality on three point seven percent of tasks, and it adds latency, most of which a parallel schedule could remove.

The title states the whole design in seven words. An agent that judges content by what it says can be talked into anything, because persuasion is exactly what injected text is for. An agent that judges content by what it is and where it came from inherits the browser's existing defences, and the model is left deciding one element at a time with only that element's power at stake.