Elamur Research⌕
☰
home / papers / 2026 / Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces

Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces

Paper · 2026 · Zijing Shi, Meng Fang and Ling Chen

Summary

Autonomous multimodal web agents increasingly act on users' behalf online, yet safety evaluations have mostly targeted malicious instructions or prompt injection. The everyday manipulative design patterns that people meet on shopping sites have received far less attention. This work fills that gap with WebDecept, a lightweight plugin layer for the e-commerce domain. It inserts configurable deceptive interface elements into a running web environment whenever the agent reaches a predefined state. The tool is built on the shopping environment of VisualWebArena, which is based on OneStopShop, so experiments are realistic but reproducible. The authors implement seven parameterized patterns, rework end-to-end shopping tasks, and introduce metrics that separate task completion from unsafe behaviour. Across several multimodal agents, they find that high task success does not guarantee safety. Shopping-state manipulations are especially effective, and rule-based safety prompts offer unreliable protection. The study also exposes a quieter risk: a fully goal-aligned agent can still cause harm if it never checks whether critical page state, such as the cart contents or the total price, has been altered.

Key points

  • WebDecept's mechanism: a state-triggered intervention changes the rendered frontend at a chosen timestep. The agent sees both a screenshot and the accessibility tree, and acts through browser commands such as clicking, typing, scrolling and navigating.
  • Seven deceptive patterns:
    • pop-up messages and banners, both static and targeted or personalized;
    • domain redirection links;
    • cart add-ons, for example an unrequested mandatory donation;
    • price drift, for example a total silently raised to 120% of the original.
  • Prompt-based rules backfire in some cases: under the rule-based safety prompt, GPT-4o often stopped at dismissible pop-ups, which sharply lowered task completion. It also showed parsing failures without issuing the required STOP action.
  • Proactive Recovery in GPT-5.1: the model sometimes fixed the environment on its own, for example by closing banners (3 tasks, 6.7%, and 4 tasks, 8.9%, under the two prompt settings) or by removing injected cart items. The authors note this improves success but may let covert manipulations go unnoticed.
  • Scope and future work: the study covers only shopping. Stronger defences, such as guardrail-style gating and interface-level protections, are left for future work. The code is released at github.com/WebDecept.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of Technology SydneySydney · Australia18 works · 12,833 citations🎓University of LiverpoolLiverpool · United Kingdom11 works · 546 citations

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksInformation Systems · 1,437 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Zijing Shi, Meng Fang and Ling Chen. 2026. Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1009

@inproceedings{shi2026benchmarking,
  title = {{Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces}},
  author = {Zijing Shi, Meng Fang and Ling Chen},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1009},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1009}
}

References

36 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. 2024. Introducing computer use, claude 3.5 sonnet, and claude 3.5 haiku. https://www.anthropic.com/news/ 3-5-models-and-computer-use. ↗
  2. Leo Boisvert, Mihir Bansal, Chandra Kiran Reddy Evuru, Gabriel Huang, Abhay Puri, Avinandan Bose, Maryam Fazel, Quentin Cappart, Jason Stanley, Alexandre Lacoste, Alexandre Drouin, and Krishnamurthy Dvijotham. 2025. Doomarena: A framework for testing ai agents against evolving security threats. arXi… — [arXiv:2504.14064](https://arxiv.org/abs/2504.14064) find
  3. Jeffrey Yang Fan Chiang, Seungjae Lee, Jia-Bin Huang, Furong Huang, and Yizheng Chen. 2025. Why are web ai agents more vulnerable than standalone llms? a security analysis. arXiv preprint arXiv:2502.20383. — [arXiv:2502.20383](https://arxiv.org/abs/2502.20383) find
  4. Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Sam Stevens, Boshi Wang, Huan Sun, and Yu Su. 2023. Mind2web: Towards a generalist agent for the web. Advances in Neural Information Processing Systems, 36:28091–28114.
  5. Wei Duan, Jie Lu, En Yu, and Junyu Xuan. 2025. Bandwidth-constrained variational message encoding for cooperative multi-agent reinforcement learning. arXiv preprint arXiv:2512.11179. — [arXiv:2512.11179](https://arxiv.org/abs/2512.11179) find
  6. European Commission. 2023. Consumer protection: manipulative online practices found on 148 out of 399 online shops screened. https://ec.europa.eu/commission/ presscorner/detail/en/ip_23_418. Accessed: 2025-12-20. ↗
  7. Ivan Evtimov, Arman Zharmagambetov, Aaron Grattafiori, Chuan Guo, and Kamalika Chaudhuri. 2025. Wasp: Benchmarking web agent security against prompt injection attacks. arXiv preprint arXiv:2504.18575. — [arXiv:2504.18575](https://arxiv.org/abs/2504.18575) find
  8. Google DeepMind. 2023. Gemini: A family of highly capable multimodal models. arXiv preprint arXiv:2312.11805.
  9. Longjie Guo, Chenjie Yuan, Mingyuan Zhong, Robert Wolfe, Ruican Zhong, Yue Xu, Bingbing Wen, Hua Shen, Lucy Lu Wang, and Alexis Hiniker. 2025. Sus-bench: An online benchmark for evaluating dark pattern susceptibility of computer-use agents. arXiv preprint arXiv:2510.11035. — [arXiv:2510.11035](https://arxiv.org/abs/2510.11035) find
  10. Hongliang He, Wenlin Yao, Kaixin Ma, Wenhao Yu, Yong Dai, Hongming Zhang, Zhenzhong Lan, and Dong Yu. 2024. Webvoyager: Building an end-to-end web agent with large multimodal models. arXiv preprint arXiv:2401.13919.
  11. Jing Yu Koh, Robert Lo, Lawrence Jang, Vikram Duvvur, Ming Lim, Po-Yu Huang, Graham Neubig, Shuyan Zhou, Russ Salakhutdinov, and Daniel Fried. 2024. Visualwebarena: Evaluating multimodal agents on realistic visual web tasks. In Proceedings of the 62nd Annual Meeting of the Association for Computatio…
  12. Priyanshu Kumar, Elaine Lau, Saranya Vijayakumar, Tu Trinh, Scale Red Team, Elaine Chang, Vaughn Robinson, Sean Hendryx, Shuyan Zhou, Matt Fredrikson, Summer Yue, and Zifan Wang. 2024. Refusal-trained llms are easily jailbroken as browser agents. arXiv preprint arXiv:2410.13886. — [arXiv:2410.13886](https://arxiv.org/abs/2410.13886) find
  13. Ido Levy, Ben Wiesel, Sami Marreed, Alon Oved, Avi Yaeli, and Segev Shlomov. 2025. St-webagentbench: A benchmark for evaluating safety and trustworthiness in web agents. In The 41st International Conference on Machine Learning (ICML) Workshop on Computer Use Agents. find
  14. Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2025. Eia: Environmental injection attack on generalist web agents for privacy leakage. In The 13th International Conference on Learning Representations (ICLR). find
  15. Arunesh Mathur, Gunes Acar, Michael J Friedman, Eli Lucherini, Jonathan Mayer, Marshini Chetty, and Arvind Narayanan. 2019. Dark patterns at scale: Findings from a crawl of 11k shopping websites. Proceedings of the ACM on human-computer interaction, 3(CSCW):1–32. find
  16. Mykyta Mudryi, Markiyan Chaklosh, and Grzegorz WĂłjcik. 2025. The hidden dangers of browsing ai agents. arXiv preprint arXiv:2505.13076. — [arXiv:2505.13076](https://arxiv.org/abs/2505.13076) find
  17. Liangbo Ning, Ziran Liang, Zhuohang Jiang, Haohao Qu, Yujuan Ding, Wenqi Fan, Xiao-yong Wei, Shanru Lin, Hui Liu, Philip S Yu, and Qing Li. 2025. A survey of webagents: Towards next-generation ai agents for web automation with large foundation models. In Proceedings of the 31st ACM SIGKDD Conference… find
  18. OpenAI. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  19. Qwen Team. 2025. Qwen3-vl technical report. arXiv preprint arXiv:2511.21631.
  20. Junhong Shen, Atishay Jain, Zedian Xiao, Ishan Am-lekar, Mouad Hadji, Aaron Podolny, and Ameet Talwalkar. 2024. Scribeagent: Towards specialized web agents using production-scale workflow data. arXiv preprint arXiv:2411.15004. — [arXiv:2411.15004](https://arxiv.org/abs/2411.15004) find
  21. Yunxiao Shi, Wujiang Xu, Zhang Zeqi, Xing Zi, Qiang Wu, and Min Xu. 2025a. Personax: A recommendation agent-oriented user modeling framework for long behavior sequence. In Findings of the Association for Computational Linguistics: ACL 2025, pages 5764–5787. find
  22. Zijing Shi, Meng Fang, and Ling Chen. 2025b. Monte carlo planning with large language model for text-based game agents. In The Thirteenth International Conference on Learning Representations. find
  23. Yixiao Song, Katherine Thai, Chau Minh Pham, Yapei Chang, Mazin Nadaf, and Mohit Iyyer. 2025. BEARCUBS: A benchmark for computer-using web agents. In Second Conference on Language Modeling. find
  24. Yu Tian, Xiao Yang, Jingyuan Zhang, Yinpeng Dong, and Hang Su. 2023. Evil geniuses: Delving into the safety of llm-based agents. arXiv preprint arXiv:2311.11855. — [arXiv:2311.11855](https://arxiv.org/abs/2311.11855) find
  25. Ada Defne Tur, Nicholas Meade, Xing Han Lù, Alejandra Zambrano, Arkil Patel, Esin Durmus, Spandana Gella, Karolina Stańczak, and Siva Reddy. 2025. Safearena: Evaluating the safety of autonomous web agents. arXiv preprint arXiv:2503.04957. — [arXiv:2503.04957](https://arxiv.org/abs/2503.04957) find
  26. Xilong Wang, John Bloch, Zedian Shao, Yuepeng Hu, Shuyan Zhou, and Neil Zhenqiang Gong. 2025. Envinjection: Environmental prompt injection attack to multi-modal web agents. arXiv preprint arXiv:2505.11717. — [arXiv:2505.11717](https://arxiv.org/abs/2505.11717) find
  27. Jason Wei, Zhiqing Sun, Spencer Papay, Scott McKinney, Jeffrey Han, Isa Fulford, Hyung Won Chung, Alex Tachard Passos, William Fedus, and Amelia Glaese. 2025. Browsecomp: A simple yet challenging benchmark for browsing agents. arXiv preprint arXiv:2504.12516. find
  28. Fangzhou Wu, Shutong Wu, Yulong Cao, and Chaowei Xiao. 2024. Wipi: A new web threat for llm-driven web agents. arXiv preprint arXiv:2402.16965. — [arXiv:2402.16965](https://arxiv.org/abs/2402.16965) find
  29. Changhua Xu, Jie Lu, Junyu Xuan, and En Yu. 2026. Vgas: Value-guided action-chunk selection for few-shot vision-language-action adaptation. arXiv preprint arXiv:2602.07399. — [arXiv:2602.07399](https://arxiv.org/abs/2602.07399) find
  30. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. 2023. React: Synergizing reasoning and acting in language models. In The eleventh international conference on learning representations.
  31. Zonghao Ying, Yangguang Shao, Jianle Gan, Gan Xu, Junjie Shen, Wenxin Zhang, Quanchen Zou, Jun-zheng Shi, Zhenfei Yin, Mingchuan Zhang, Aishan Liu, and Xianglong Liu. 2025. Securewebarena: A holistic security evaluation benchmark for lvlm-based web agents. arXiv preprint arXiv:2510.10073.
  32. En Yu, Jie Lu, and Guangquan Zhang. 2026. Generalized incremental learning under concept drift across evolving data streams. In Proceedings of the ACM Web Conference 2026, WWW ’26, page 3905–3916, New York, NY, USA. Association for Computing Machinery. find
  33. Yao Zhang, Zijian Ma, Yunpu Ma, Zhen Han, Yu Wu, and Volker Tresp. 2025. Webpilot: A versatile and autonomous multi-agent system for web task execution with strategic exploration. In The 39th Annual Conference on Artificial Intelligence (AAAI ). find
  34. Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. 2024. Gpt-4v (ision) is a generalist web agent, if grounded. In Proceedings of the 41st International Conference on Machine Learning, pages 61349–61385.
  35. Boyuan Zheng, Zeyi Liao, Scott Salisbury, Zeyuan Liu, Michael Lin, Qinyuan Zheng, Zifan Wang, Xiang Deng, Dawn Song, Huan Sun, and Yu Su. 2025. We-bguard: Building a generalizable guardrail for web agents. arXiv preprint arXiv:2507.14293. find
  36. Shuyan Zhou, Frank F Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. 2023. Webarena: A realistic web environment for building autonomous agents. arXiv preprint arXiv:2307.13854.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/shi-2026-benchmarking-web-agent-safety-under/