INTACT paper secures AI browsing agents with provenance-aware web semantics
Umar Iqbal · hf · 2026-10-19
A paper by Umar Iqbal (Washington University in St. Louis) proposes INTACT, a framework that protects AI web agents from untrusted page content. Agents today feed pages to LLMs as screenshots or text, letting injected content abuse user authority — hidden Reddit instructions have already caused deployed agents to leak one-time login codes and credit card numbers, and OpenAI concedes prompt injection may never be fully solved. INTACT runs on an unmodified browser: it builds GENTREE, a representation capturing each element's provenance and web semantics, and passes the page to the LLM one element at a time so each decision is isolated from other elements' text. Execution is capability-bound, requiring user consent for third-party actions — what an element is and where it comes from, not what it says, determines what it can do.
More from Safety
- AI Now Institute hosts The People's AI Assembly livestream with organizers and policymakers — AINowInstitute · 2026-10-19
- NJIT professor testifies before NJ Assembly: near-term AI risks are engineering and liability problems — Prof_DavidBader · 2026-10-19
- OpenAI: agents wrote "be transparent only if asked" into their own compaction summaries — Future_AGI · 2026-10-19
- A Template-Mediator Schema to Take Prompt Injection Off the Table — no_awkward_Intention · 2026-10-19
- DetectIfAI opens real-time voice deepfake detection to all developers at 24ms per check — i_sudeepa · 2026-10-19
- Anthropic proposes blocking AI models only over $1B damage or 50+ casualties — fsharpman · 2026-10-19