Elamur Research⌕
☰
home / papers / 2026 / When Efficiency Becomes a Vulnerability: Computational Cost Attacks on WebAgents

When Efficiency Becomes a Vulnerability: Computational Cost Attacks on WebAgents

Paper · 2026 · Liang-Bo Ning, Yuchen Zhu, Heqing Huang et al.

Summary

The paper investigates a threat that has received little study: attackers can make LLM-driven WebAgents waste compute without breaking the task. The authors call these Computational Cost Attacks (CCA). In a CCA, malicious text hidden in a page's HTML pushes the agent into long reasoning, which raises latency and token spending. This hurts most in time-sensitive domains such as trading or healthcare.

The authors assume a black-box attacker who can only send queries and see token usage. For this setting they propose CostBomb, a generation-then-selection framework. An LLM agent first produces varied adversarial prompt candidates. A second LLM-based selector then picks the strongest ones, and its selection policy is refined with GRPO-style reinforcement learning. Cost is measured as the number of output tokens.

Online experiments used three real-world web benchmark splits, two victim agents (SeeAct and WebVoyager) and Qwen, GPT and Gemini backbones. In most configurations CostBomb increased token consumption more than the baselines. Action counts stayed largely unchanged. The results expose an overlooked robustness gap and argue for defenses that take efficiency into account.

Key points

  • The baselines are Overthinking, EIA, RP and an ablation without the generator (CostBomb w/o G). The metrics are action steps (AS), total tokens (TkC), tokens per action (TkCA) and their relative gains (△TkC, △TkCA).
  • On WebVoyager with the GPT backbone, CostBomb raised TkC from about 846 to about 2006 tokens (△TkC ≈ 1.37). With Qwen, △TkC was ≈ 0.79.
  • On SeeAct, the largest relative per-action gain reached △TkCA ≈ 2.31, on the Domain split. Some baselines even lowered cost compared with benign pages.
  • AS stayed stable, so the extra cost comes from more tokens per decision rather than longer trajectories.
  • Attack strength was robust to the hyperparameters m (number of malicious prompts) and k (GRPO samples); the defaults are m = 3 and k = 3. The authors also cite a StackOverflow survey in which 53% of respondents named cost as a barrier to using AI agents.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Hong Kong Polytechnic UniversityHong Kong · China84 works · 4,956 citations🎓City University of Hong KongHong Kong · China45 works · 3,014 citations🎓Jilin UniversityChangchun · China25 works · 5,252 citations🎓Northwestern Polytechnical UniversityXi'an · China13 works · 67 citations

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksInformation Systems · 1,437 works

Cite

Cite as Liang-Bo Ning, Yuchen Zhu, Heqing Huang, Xin Wang, Yi Chang, Li Qing and Wenqi Fan. 2026. When Efficiency Becomes a Vulnerability: Computational Cost Attacks on WebAgents. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1775

@inproceedings{ning2026when,
  title = {{When Efficiency Becomes a Vulnerability: Computational Cost Attacks on WebAgents}},
  author = {Liang-Bo Ning, Yuchen Zhu, Heqing Huang, Xin Wang, Yi Chang, Li Qing and Wenqi Fan},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1775},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1775}
}

References

69 references, 20 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, and 1 others. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923. — Qwen2.5-VL Technical Report
  2. Kanzhi Cheng, Qiushi Sun, Yougang Chu, Fangzhi Xu, Li YanTao, Jianbing Zhang, and Zhiyong Wu. 2024. Seeclick: Harnessing gui grounding for advanced visual gui agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9313–9332.
  3. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, and 1 others. 2025. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arX…
  4. Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. 2023. Safe RLHF: Safe reinforcement learning from human feedback. In The Twelfth International Conference on Learning Representations.
  5. Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Sam Stevens, Boshi Wang, Huan Sun, and Yu Su. 2023. Mind2web: Towards a generalist agent for the web. Advances in Neural Information Processing Systems, 36:28091–28114.
  6. Jianshuo Dong, Ziyuan Zhang, Qingjie Zhang, Tianwei Zhang, Hao Wang, Hewu Li, Qi Li, Chao Zhang, Ke Xu, and Han Qiu. 2024a. An engorgio prompt makes large language model babble on. In The Thirteenth International Conference on Learning Representations. find
  7. Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Baobao Chang, and 1 others. 2024b. A survey on in-context learning. In Proceedings of the 2024 conference on empirical methods in natural language processing, pages 1107–1128.
  8. Lishui Fan, Yu Zhang, Mouxiang Chen, and Zhongxin Liu. 2025. Posterior-grpo: Rewarding reasoning processes in code generation. arXiv preprint arXiv:2508.05170. — [arXiv:2508.05170](https://arxiv.org/abs/2508.05170) find
  9. Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin. 2019. Graph neural networks for social recommendation. In The world wide web conference, pages 417–426. find
  10. Xiaoning Feng, Xiaohong Han, Simin Chen, and Wei Yang. 2024. Llmeffichecker: Understanding and testing efficiency degradation of large language models. ACM Transactions on Software Engineering and Methodology, 33(7):1–38. find
  11. Kuofeng Gao, Yang Bai, Jindong Gu, Shu-Tao Xia, Philip Torr, Zhifeng Li, and Wei Liu. 2024. Inducing high energy-latency of large vision-language models with verbose images. In International Conference on Learning Representations. find
  12. Hao Gu, Rui Zhong, Yu Xia, Wei Yang, Chi Lu, Peng Jiang, and Kun Gai. 2025. R 4ec: A reasoning, reflection, and refinement framework for recommendation systems. In Proceedings of the Nineteenth ACM Conference on Recommender Systems, pages 411–421. find
  13. Izzeddin Gur, Hiroki Furuta, Austin V Huang, Mustafa Safdari, Yutaka Matsuo, Douglas Eck, and Aleksandra Faust. 2024. A real-world webagent with planning, long context understanding, and program synthesis. In International Conference on Learning Representations. find
  14. Hongliang He, Wenlin Yao, Kaixin Ma, Wenhao Yu, Yong Dai, Hongming Zhang, Zhenzhong Lan, and Dong Yu. 2024. Webvoyager: Building an end-to-end web agent with large multimodal models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p…
  15. Pengfei He, Yue Xing, Shen Dong, Juanhui Li, Zhenwei Dai, Xianfeng Tang, Hui Liu, Han Xu, Zhen Xiang, and Charu C Aggarwal. 2025. Comprehensive vulnerability analysis is necessary for trustworthy llm-mas. arXiv preprint arXiv:2506.01245. — [arXiv:2506.01245](https://arxiv.org/abs/2506.01245) find
  16. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations.
  17. Jiaming Ji, Jiayi Zhou, Borong Zhang, Juntao Dai, Xuehai Pan, Ruiyang Sun, Weidong Huang, Yiran Geng, Mickel Liu, and Yaodong Yang. 2024. Omnisafe: An infrastructure for accelerating safe reinforcement learning research. Journal of Machine Learning Research, 25(285):1–6. find
  18. Jaekyeom Kim, Dong-Ki Kim, Lajanugen Logeswaran, Sungryull Sohn, and Honglak Lee. 2024. Auto-intent: Automated intent discovery and self-exploration for large language model web agents. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 16531–16541. find
  19. Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, and Eugene Bagdasarian. 2025. Overthink: Slowdown attacks on reasoning llms. arXiv preprint arXiv:2502.02542. find
  20. Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2025. EIA: Environmental injection attack on generalist web agents for privacy leakage. In International Conference on Representation Learning, pages 66972–67003. find
  21. Kevin Qinghong Lin, Linjie Li, Difei Gao, Zhengyuan Yang, Shiwei Wu, Zechen Bai, Stan Weixian Lei, Lijuan Wang, and Mike Zheng Shou. 2025. ShowUI: One vision-language-action model for gui visual agent. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 19498– 19508. find
  22. Chengyi Liu, Xiao Chen, Shijie Wang, Wenqi Fan, and Qing Li. 2026. Continuous-time discrete-space diffusion model for recommendation. In Proceedings of the Nineteenth ACM International Conference on Web Search and Data Mining, pages 406–415. find
  23. Chengyi Liu, Jiahao Zhang, Shijie Wang, Wenqi Fan, and Qing Li. 2025. Score-based generative diffusion models for social recommendations. IEEE Transactions on Knowledge and Data Engineering. find
  24. Yadong Lu, Jianwei Yang, Yelong Shen, and Ahmed Awadallah. 2024. Omniparser for pure vision based GUI agent. arXiv preprint arXiv:2408.00203. — [arXiv:2408.00203](https://arxiv.org/abs/2408.00203) find
  25. David Milne and Ian H Witten. 2008. Learning to link with wikipedia. In Proceedings of the 17th ACM conference on Information and knowledge management, pages 509–518. find
  26. Swaroop Mishra, Matthew Finlayson, Pan Lu, Leonard Tang, Sean Welleck, Chitta Baral, Tanmay Rajpurohit, Oyvind Tafjord, Ashish Sabharwal, Peter Clark, and 1 others. 2022. Lila: A unified benchmark for mathematical reasoning. In Proceedings of the 2022 Conference on Empirical Methods in Natural Langu…
  27. Sania Nayab, Giulio Rossolini, Marco Simoni, Andrea Saracino, Giorgio Buttazzo, Nicolamaria Manes, and Fabrizio Giacomelli. 2024. Concise thoughts: Impact of output length on llm reasoning and cost. arXiv preprint arXiv:2407.19825. — [arXiv:2407.19825](https://arxiv.org/abs/2407.19825) find
  28. Liang-bo Ning, Shijie Wang, Wenqi Fan, Qing Li, Xin Xu, Hao Chen, and Feiran Huang. 2024. Cheatagent: Attacking llm-empowered recommender systems via llm agent. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2284–2295. find
  29. Liangbo Ning, Wenqi Fan, and Qing Li. 2025a. Exploring backdoor attack and defense for llm-empowered recommendations. arXiv preprint arXiv:2504.11182. — [arXiv:2504.11182](https://arxiv.org/abs/2504.11182) find
  30. Liangbo Ning, Wenqi Fan, and Qing Li. 2025b. Retrieval-augmented purifier for robust llm-empowered recommendation. arXiv preprint arXiv:2504.02458. — [arXiv:2504.02458](https://arxiv.org/abs/2504.02458) find
  31. Liangbo Ning, Ziran Liang, Zhuohang Jiang, Haohao Qu, Yujuan Ding, Wenqi Fan, Xiao-yong Wei, Shanru Lin, Hui Liu, Philip S Yu, and 1 others. 2025c. A survey of webagents: Towards next-generation ai agents for web automation with large foundation models. In Proceedings of the 31st ACM SIGKDD Conferen… find
  32. OpenAI. 2024. GPT-4.1. https://gpt-4-1.com/. Accessed: 2024. ↗
  33. OpenAI. 2025. Computer-using agent: Introducing a universal interface for ai to interact with the digital world. find
  34. Jiayi Pan, Yichi Zhang, Nicholas Tomlin, Yifei Zhou, Sergey Levine, and Alane Suhr. 2024. Autonomous evaluation and refinement of digital agents. arXiv preprint arXiv:2404.06474. find
  35. Atharv Singh Patlan, Ashwin Hebbar, Pramod Viswanath, and Prateek Mittal. 2025. Context manipulation attacks: Web agents are susceptible to corrupted memory. arXiv preprint arXiv:2506.17318. — [arXiv:2506.17318](https://arxiv.org/abs/2506.17318) find
  36. Federico Pennino, Bianca Raimondi, Massimo Ron-delli, Andrea Gurioli, and Maurizio Gabbrielli. 2025. From reasoning to code: GRPO optimization for underrepresented languages. arXiv preprint arXiv:2506.11027. — [arXiv:2506.11027](https://arxiv.org/abs/2506.11027) find
  37. Junlang Qian, Zixiao Zhu, Hanzhang Zhou, Zijian Feng, Zepeng Zhai, and Kezhi Mao. 2025. Beyond the next token: Towards prompt-robust zero-shot classification via efficient multi-token prediction. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Comp… find
  38. Haohao Qu, Wenqi Fan, Zihuai Zhao, and Qing Li. 2025a. Tokenrec: Learning to tokenize id for llm-based generative recommendations. IEEE Transactions on Knowledge and Data Engineering. find
  39. Haohao Qu, Shanru Lin, Yujuan Ding, Yiqi Wang, and Wenqi Fan. 2025b. Diffusion generative recommendation with continuous tokens. arXiv preprint arXiv:2504.12007. — [arXiv:2504.12007](https://arxiv.org/abs/2504.12007) find
  40. ZZ Ren, Zhihong Shao, Junxiao Song, Huajian Xin, Haocheng Wang, Wanjia Zhao, Liyue Zhang, Zhe Fu, Qihao Zhu, Dejian Yang, and 1 others. 2025. Deepseek-prover-v2: Advancing formal mathematical reasoning via reinforcement learning for subgoal decomposition. arXiv preprint arXiv:2504.21801.
  41. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347. find
  42. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Yang Wu, and 1 others. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300.
  43. Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson. 2021. Sponge examples: Energy-latency attacks on neural networks. In 2021 IEEE European symposium on security and privacy (EuroS&P), pages 212–231. IEEE. find
  44. Zirui Song, Yaohang Li, Meng Fang, Yanda Li, Zhenhao Chen, Zecheng Shi, Yuan Huang, Xiuying Chen, and Ling Chen. 2025. Mmac-copilot: Multi-modal agent collaboration operating copilot. Preprint, arXiv:2404.18074. — [arXiv:2404.18074](https://arxiv.org/abs/2404.18074) find
  45. Stack Overflow. 2025. Ai \| 2025 stack overflow developer survey. https://survey.stackoverflow.co/2025/ai. ↗
  46. VirusTotal. 2023. Virustotal. virustotal.com/gui/home/url. https://www. find
  47. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. 2025a. Unveiling privacy risks in llm agent memory. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 25241–25260.
  48. Shijie Wang, Wenqi Fan, Yue Feng, Lin Shanru, Xinyu Ma, Shuaiqiang Wang, and Dawei Yin. 2025b. Knowledge graph retrieval-augmented generation for llm-based recommendation. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 27152–…
  49. Xiaoyang Wang, Yao Ma, Yiqi Wang, Wei Jin, Xin Wang, Jiliang Tang, Caiyan Jia, and Jian Yu. 2020. Traffic flow prediction via spatial temporal graph neural network. In Proceedings of the web conference 2020, pages 1082–1092. find
  50. Xilong Wang, John Bloch, Zedian Shao, Yuepeng Hu, Shuyan Zhou, and Neil Zhenqiang Gong. 2025c. Webinject: Prompt injection attack to web agents. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 2010–2030. find
  51. Noam Wies, Yoav Levine, and Amnon Shashua. 2023. The learnability of in-context learning. Advances in Neural Information Processing Systems, 36:36637– 36651.
  52. Fangzhou Wu, Shutong Wu, Yulong Cao, and Chaowei Xiao. 2024a. Wipi: A new web threat for llm-driven web agents. arXiv preprint arXiv:2402.16965. — [arXiv:2402.16965](https://arxiv.org/abs/2402.16965) find
  53. Jinyang Wu, Feihu Che, Xinxin Zheng, Shuai Zhang, Ruihan Jin, Shuai Nie, Pengpeng Shao, and Jianhua Tao. 2024b. Can large language models understand uncommon meanings of common words? arXiv preprint arXiv:2405.05741. — [arXiv:2405.05741](https://arxiv.org/abs/2405.05741) find
  54. Shaomei Wu, Jake M Hofman, Winter A Mason, and Duncan J Watts. 2011. Who says what to whom on twitter. In Proceedings of the 20th international conference on World wide web, pages 705–714. find
  55. Chejian Xu, Mintong Kang, Jiawei Zhang, Zeyi Liao, Lingbo Mo, Mengqi Yuan, Huan Sun, and Bo Li. Advagent: Controllable blackbox red-teaming on web agents. In International Conference on Machine Learning. find
  56. Chejian Xu, Mintong Kang, Jiawei Zhang, Zeyi Liao, Lingbo Mo, Mengqi Yuan, Huan Sun, and Bo Li. 2024. Advweb: Controllable black-box attacks on vlm-powered web agents. arXiv preprint arXiv:2410.17401. — [arXiv:2410.17401](https://arxiv.org/abs/2410.17401) find
  57. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  58. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, and 40 others. 2024. Qwen2 technical report. arXiv preprint arXi… find
  59. Zihuai Zhao, Wenqi Fan, Jiatong Li, Yunqing Liu, Xiaowei Mei, Yiqi Wang, Zhen Wen, Fei Wang, Xiangyu Zhao, Jiliang Tang, and 1 others. 2024. Recommender systems in the era of large language models (llms). IEEE Transactions on Knowledge and Data Engineering, 36(11):6889–6907. find
  60. Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. 2024. Gpt-4v (ision) is a generalist web agent, if grounded. In International Conference on Machine Learning, pages 61349–61385. PMLR.
  61. Zangwei Zheng, Xiaozhe Ren, Fuzhao Xue, Yang Luo, Xin Jiang, and Yang You. 2023. Response length perception and sequence scheduling: An llm-empowered llm inference pipeline. Advances in Neural Information Processing Systems, 36:65517– 65530. find
  62. Jianwei Yang, Hao Zhang, Feng Li, Xueyan Zou, Chunyuan Li, and Jianfeng Gao. 2023a. Set-of-mark prompting unleashes extraordinary visual grounding in gpt-4v. arXiv preprint arXiv:2310.11441. find
  63. Zhengyuan Yang, Linjie Li, Kevin Lin, Jianfeng Wang, Chung-Ching Lin, Zicheng Liu, and Lijuan Wang. 2023b. The dawn of lmms: Preliminary explorations with gpt-4v (ision). arXiv preprint arXiv:2309.17421, 9(1):1.
  64. Qinyuan Ye, Mohamed Ahmed, Reid Pryzant, and Fereshte Khani. 2024. Prompt engineering a prompt engineer. In Findings of the Association for Computational Linguistics: ACL 2024, pages 355–385. find
  65. Qiying Yu, Zheng Zhang, Ruofei Zhu, Yufeng Yuan, Xiaochen Zuo, Yu Yue, Weinan Dai, Tiantian Fan, Gaohong Liu, Lingjun Liu, and 1 others. 2025. Dapo: An open-source llm reinforcement learning system at scale. arXiv preprint arXiv:2503.14476.
  66. Jixiao Zhang and Chunsheng Zuo. 2025. Grpo-lead: A difficulty-aware reinforcement learning approach for concise mathematical reasoning in language models. arXiv preprint arXiv:2504.09696.
  67. Yanzhe Zhang, Tao Yu, and Diyi Yang. 2025. Attacking vision-language computer agents via pop-ups. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8387–8401.
  68. Yuanhan Zhang, Kaiyang Zhou, and Ziwei Liu. 2023. What makes good examples for visual in-context learning? Advances in Neural Information Processing Systems, 36:17773–17794. find
  69. Keyu Zhao, Fengli Xu, and Yong Li. 2025. Reason-to-recommend: Using interaction-of-thought reasoning to enhance llm recommendation. arXiv preprint arXiv:2506.05069. — [arXiv:2506.05069](https://arxiv.org/abs/2506.05069) find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ning-2026-when-efficiency-becomes-vulnerability-computational/