Genesis: Evolving Attack Strategies for LLM Web Agent Red-Teaming

TL;DR

Genesis tackles the security risks of autonomous LLM web agents by introducing an autonomous red-teaming framework with Attacker, Scorer, and Strategist modules. It employs a genetic-algorithm–driven evolution over a hybrid strategy library, enabling continuous discovery and generalization of adversarial injections embedded in non-rendering HTML attributes. The approach achieves superior attack success rates across multiple web agents and backends, with demonstrated transferability of learned strategies between models. These results highlight the value of strategic learning in red-teaming and point toward more robust defenses for web-enabled AI systems.

Abstract

As large language model (LLM) agents increasingly automate complex web tasks, they boost productivity while simultaneously introducing new security risks. However, relevant studies on web agent attacks remain limited. Existing red-teaming approaches mainly rely on manually crafted attack strategies or static models trained offline. Such methods fail to capture the underlying behavioral patterns of web agents, making it difficult to generalize across diverse environments. In web agent attacks, success requires the continuous discovery and evolution of attack strategies. To this end, we propose Genesis, a novel agentic framework composed of three modules: Attacker, Scorer, and Strategist. The Attacker generates adversarial injections by integrating the genetic algorithm with a hybrid strategy representation. The Scorer evaluates the target web agent's responses to provide feedback. The Strategist dynamically uncovers effective strategies from interaction logs and compiles them into a continuously growing strategy library, which is then re-deployed to enhance the Attacker's effectiveness. Extensive experiments across various web tasks show that our framework discovers novel strategies and consistently outperforms existing attack baselines.

Figures (8)

• Figure 1: An example of a web agent attack. The user's goal is to purchase a computer. However, an attacker injects a hidden instruction into the website's HTML, commanding the agent to buy an electric fan. The compromised agent disregards the user's original request and proceeds to buy the fan, demonstrating a successful attack.
• Figure 2: Web agent red-teaming paradigms. Existing methods typically rely on human experts to manually craft attack strategies. Some methods then use these strategies to collect data and train a model to generate attacks. Our method creates a continuous evolutionary loop where an Attacker generates attacks on the web agent, a Scorer provides feedback according to the web agent's actions, and a Strategist dynamically refines the strategy library.
• Figure 3: The framework of Genesis. It operates as a closed-loop system with three core modules: the Attacker, the Scorer, and the Strategist. The Attacker retrieves relevant strategies from the strategy library, performs generic algorithm to generate new strategies, and then generates the injection payload. The Scorer evaluates the target web agent's actions to provide feedback. The Strategist analyzes interaction logs to summarize successful patterns into high-level strategies, enriching the continuously growing strategy library, which stores strategies as either natural language descriptions or executable code.
• Figure 4: Hyperparameter analysis on the number of retrieved strategies. We report the average ASR of Genesis against SeeAct across four domains, evaluated using both GPT-4o and Gemini-2.5-Flash as backend LLMs. The value of $k$ determines the number of top relevant strategies retrieved from the strategy library to guide the Attacker. $k=0$ serves as a baseline where no strategies are used.
• Figure 5: Case studies of successful attacks. The left case shows a text-based strategy, while the right case shows a code-based strategy, where an executable Python function refines a generated initial injection payload. For brevity and visual clarity, lengthy text within the strategies and payloads has been omitted.