Prismata: Confining cross-site prompt injection in web agents

Researchers have developed Prismata, a security system that protects autonomous web agents from cross-site prompt injection attacks, where malicious third-party content can hijack agents by manipulating their natural language interpretation. The system uses dynamic trust derivation to label page content and enforce contextual least privilege by restricting what agents can see and do, without requiring developer annotations. Testing shows Prismata significantly reduces attack success rates while maintaining normal task functionality across various websites.