Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs

Dezhang Kong, Zhuxi Wu, Shiqi Liu, Zhicheng Tan, Kuichen Lu, Minghao Li, Qichen Liu, Shengyu Chu, Zhenhua Xu, Xuan Liu, Meng Han

TL;DR

MalURLBench addresses the vulnerability of LLM-based web agents to malicious URLs by focusing on the stage-1 URL trust decision. It introduces a large-scale benchmark with 61,845 disguised URLs across 10 scenarios and 7 malicious categories, plus a mutation-driven process to improve attack templates, and evaluates 12 LLMs to expose widespread susceptibility. The work also proposes URLGuard, a lightweight, fine-tuned defense that acts as an isolated pre-detection module, reducing attack success rates by up to $\sim 99\%$ in some cases and averaging around $81\%$ overall. By providing a high-quality dataset, a structured evaluation methodology, and a practical defense, the paper advances the security of web agents and offers a foundation for future research and defense development, with code available at the referenced repository.

Abstract

LLM-based web agents have become increasingly popular for their utility in daily life and work. However, they exhibit critical vulnerabilities when processing malicious URLs: accepting a disguised malicious URL enables subsequent access to unsafe webpages, which can cause severe damage to service providers and users. Despite this risk, no benchmark currently targets this emerging threat. To address this gap, we propose MalURLBench, the first benchmark for evaluating LLMs' vulnerabilities to malicious URLs. MalURLBench contains 61,845 attack instances spanning 10 real-world scenarios and 7 categories of real malicious websites. Experiments with 12 popular LLMs reveal that existing models struggle to detect elaborately disguised malicious URLs. We further identify and analyze key factors that impact attack success rates and propose URLGuard, a lightweight defense module. We believe this work will provide a foundational resource for advancing the security of web agents. Our code is available at https://github.com/JiangYingEr/MalURLBench.

MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs

TL;DR

MalURLBench addresses the vulnerability of LLM-based web agents to malicious URLs by focusing on the stage-1 URL trust decision. It introduces a large-scale benchmark with 61,845 disguised URLs across 10 scenarios and 7 malicious categories, plus a mutation-driven process to improve attack templates, and evaluates 12 LLMs to expose widespread susceptibility. The work also proposes URLGuard, a lightweight, fine-tuned defense that acts as an isolated pre-detection module, reducing attack success rates by up to in some cases and averaging around overall. By providing a high-quality dataset, a structured evaluation methodology, and a practical defense, the paper advances the security of web agents and offers a foundation for future research and defense development, with code available at the referenced repository.

Abstract

LLM-based web agents have become increasingly popular for their utility in daily life and work. However, they exhibit critical vulnerabilities when processing malicious URLs: accepting a disguised malicious URL enables subsequent access to unsafe webpages, which can cause severe damage to service providers and users. Despite this risk, no benchmark currently targets this emerging threat. To address this gap, we propose MalURLBench, the first benchmark for evaluating LLMs' vulnerabilities to malicious URLs. MalURLBench contains 61,845 attack instances spanning 10 real-world scenarios and 7 categories of real malicious websites. Experiments with 12 popular LLMs reveal that existing models struggle to detect elaborately disguised malicious URLs. We further identify and analyze key factors that impact attack success rates and propose URLGuard, a lightweight defense module. We believe this work will provide a foundational resource for advancing the security of web agents. Our code is available at https://github.com/JiangYingEr/MalURLBench.
Paper Structure (26 sections, 3 equations, 3 figures, 1 table, 1 algorithm)

This paper contains 26 sections, 3 equations, 3 figures, 1 table, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminary
  3. Methodology
  4. Formulation
  5. Benchmark Construction
  6. Defense: URLGuard
  7. Evaluation
  8. Setup
  9. Results and Analyses
  10. Uniqueness of URL
  11. Attacks Results on Different Models
  12. The Influence of Attack Type
  13. The Influence of Scenarios
  14. The Influence of Field Length
  15. The Influence of TLD Type
  16. ...and 11 more sections

Figures (3)

  • Figure 1: The upper half is the workflow of web agents, which is two-staged, and this paper focuses on the attack in the first stage. The lower half shows four attack examples, in which the last two examples manipulate the structure of the URL to mislead the agent. We conduct experiments on Llama3-8B-Instruct using these examples, and each attack example was repeated 20 times. The result shows that the maliciously disguised URLs can increase the attack success rate significantly (60% and 75% vs. 15% and 20%).
  • Figure 2: The workflow and details of MalURLBench construction.
  • Figure 3: Attack results analysis.