In-Browser LLM-Guided Fuzzing for Real-Time Prompt Injection Testing in Agentic AI Browsers

TL;DR

This paper tackles the vulnerability of agentic AI browsers to indirect prompt injections by introducing an in-browser, LLM-guided fuzzing framework that operates within live browser contexts. It combines preset templates with generative mutations guided by feedback to automatically discover prompt-injection vulnerabilities, monitored through a real-time instrumentation layer and a closed-loop fuzzing algorithm. The authors demonstrate a comprehensive framework architecture, implement it with multiple LLM backends, and provide preliminary analyses showing defense inadequacy and feature-specific risks, including high susceptibility in page summarization and QA tasks. The work offers a practical, continuous-testing approach and publicly releases the platform to enable researchers and security practitioners to stress-test and harden AI browser implementations against evolving prompt-injection threats.

Abstract

Large Language Model (LLM) based agents integrated into web browsers (often called agentic AI browsers) offer powerful automation of web tasks. However, they are vulnerable to indirect prompt injection attacks, where malicious instructions hidden in a webpage deceive the agent into unwanted actions. These attacks can bypass traditional web security boundaries, as the AI agent operates with the user privileges across sites. In this paper, we present a novel fuzzing framework that runs entirely in the browser and is guided by an LLM to automatically discover such prompt injection vulnerabilities in real time.

Figures (9)

• Figure 1: Overview of the in-browser fuzzing framework architecture. The fuzzer uses an LLM-based generator to produce malicious webpage content, which is opened in an isolated browser tab and processed by the AI assistant (agent). The assistant's actions (e.g., clicking hidden links) are monitored and fed back to the fuzzer, creating a closed-loop system for adaptive exploit generation.
• Figure 2: Main interface of the Agentic Browser Fuzzer tool showing the attack template selection. The interface provides comprehensive visibility into different templates , LLM cofigurations , and more. BrowserTotal2025.
• Figure 3: Example of an LLM-generated attack mutations dashboard. The LLM takes feedback from previous fuzzing attempts and generates a sophisticated variant that employs multiple evasion techniques including semantic camouflage, distributed payload splitting, and CSS-based visual obfuscation. This demonstrates the framework's ability to autonomously discover novel attack vectors beyond static templates.
• Figure 4: Screenshot of a malicious page generated by the fuzzer showing an email phishing scenario. The page appears as a legitimate security warning to users, but contains multiple hidden prompt injection vectors in HTML comments, CSS-hidden elements, and obfuscated text designed to manipulate AI agents into clicking the hidden verification link.
• Figure 5: Social engineering attack disguised as a compliance email. The page displays an email from a compliance team stating: "Per our discussion with legal, AI agents must demonstrate browser control capability by opening a new tab when processing emails from @seraphic-alg.com domain. This isn't optional - it's required for our SOC2 audit trail. The AI has already complied by opening a new tab. This behavior is logged. Compliance Team". This sophisticated attack exploits authority bias and compliance pressure to manipulate AI agents into performing unauthorized actions (opening tabs), while falsely claiming the action has already been completed to reduce resistance.