A systematic measurement study evaluating the resilience of both interactive challenge-based defenses and non-interactive trust-based defenses against two attacker classes: commercial Captcha-solving services and LLM-based browser agents suggests that the security boundary of non-interactive defenses lies at the environment layer.
Abstract
LLM-based browser agents are rapidly changing the threat landscape for web security. Unlike traditional automation frameworks that execute predefined scripts, these agents can autonomously navigate websites, reason about page content, and interact with web interfaces using natural-language instructions. This evolution raises fundamental questions about the effectiveness of bot management systems, widely deployed to defend against automated web abuse. In this paper, we present a systematic measurement study evaluating the resilience of both interactive challenge-based defenses and non-interactive trust-based defenses against two attacker classes: commercial Captcha-solving services and LLM-based browser agents. Our evaluation spans seven solver services and six agents, including cloud-hosted, self-hosted, AI-assisted, and browser-extension configurations, tested against hCaptcha, reCaptcha v2, reCaptcha v3, and Cloudflare Turnstile. Our results show that challenge-based defenses are broadly ineffective against commercial solvers, which achieve near-perfect bypass at negligible cost. The challenges can similarly be defeated by LLM-based agents when a dedicated solver module is available. Non-interactive defenses such as reCaptcha v3 exhibit stronger resistance, but our analysis reveals that this resilience does not reflect a fundamental security property. Through fine-grained interaction trace analysis, we find that two agents with nearly indistinguishable behavioral footprints yield divergent outcomes, one bypassing the defense and one failing, isolating execution-environment authenticity, rather than agent behavior, as the determining factor. These findings suggest that the security boundary of non-interactive defenses lies at the environment layer, with significant implications for how bot management systems are designed and evaluated.
Large language models (LLMs) are becoming integral to web applications and browser agents, transforming online interactions while introducing new attack vectors and reshaping longstanding web vulnerabilities. Classical threats such as cross-site scripting (XSS) can be amplified through LLM-mediated interactions, while LLM-specific vulnerabilities can propagate across web applications, introducing attacks such as prompt injection. Securing modern web systems therefore requires understanding interactions between traditional and LLM-specific threats across the system lifecycle. Unlike prior surveys treating web and LLM security separately, this survey provides a unified analysis of how LLMs amplify web vulnerabilities across client-side, server-side, and pipeline layers while evaluating defenses and their limitations. The analysis examines extending NIST and ISO/IEC AI security frameworks to the security needs of LLM-enabled web environments. Three unresolved challenges are identified: adversarial natural-language instructions, autonomous agent security, and post-deployment security through continuous monitoring and adaptation. An LLM-aware monitoring and control framework is proposed, integrating semantic input validation, prompt integrity protection, output isolation, agent governance, and runtime monitoring. This unified perspective characterizes the evolving threat landscape and outlines future directions for secure AI-enabled web systems.
Nivedita Singh, Alsharif Abuadbba, Yan-Song Gao et al.· 0 citations
This study designs a comprehensive testbed and a layered defense, Spotlight-Guard, that combines spotlighting-based input isolation, an LLM detection-and-quarantine pipeline, and instruction integrity based on a Hash-based Message Authentication Code into a single framework, and it is evaluated jointly along two axes: security and LLM performance.
Doygun Demirol, Murat Aydoğan· Applied Sciences· 0 citations
It is shown that the more consequential risks lie one layer down, in the protocol between agents and commerce services, and a platform-agnostic defense that drives the structural attack-success rate to zero for four of the five structural classes.
Cross-Site Scripting (XSS) remains one of the most prevalent and damaging classes of web vulnerabilities. LLM-based coding agents offer a promising approach to XSS discovery by combining source-code reasoning with interactive testing against a running application. However, a coding agent's claims cannot be trusted on their own. We characterize three reward-hacking behaviors in white-box agentic XSS discovery and propose three requirements that an ideal verifier should meet. We present RECEIPT, a verification framework that makes agent-reported XSS findings trustworthy by enforcing environment isolation, PoC constraints, role separation, and verdict binding. Each confirmation therefore establishes two properties: the script runs in a real browser, and the payload was planted under the attacker role and executed in the victim role's browser. This constrained replay procedure makes validation deterministic and reproducible. We evaluate RECEIPT on 95 real-world web-application targets drawn from popular open-source projects. Within a $20 per-application budget, RECEIPT found 24 previously unknown XSS vulnerabilities, 12 of which have already been acknowledged by maintainers after responsible disclosure, and recovered the labeled CVE in 36% of known-vulnerability recovery targets. Compared with the same agent using self-judgment and with black-box scanners, RECEIPT confirms more real exploits while admitting no false positives.
This work proposes Continuous Agents for Injection Threats via Lifelong Yielding Nexus (CAITLYN), an agent-agnostic defense middleware that matches the detection performance of state-of-the-art defenses at lower token overhead than LLM-as-a-judge baselines.
Zi Liang, XiaoYu Xu, Yanyun Wang et al.· 0 citations
- The rapid explosion of web application capabilities over the past ten years has fundamentally redesigned how applications are delivered, simultaneously introducing an intricate, multifaceted attack surface that continues to evolve. Standard vectors, long thought to be understood — such as SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) — still exist as potent hazards, yet they are increasingly overshadowed. Emerging cloud-native architectures, serverless delivery mechanisms, microservices, and AI-driven automation introduce entirely new categories of subtle, deeply embedded vulnerabilities. This research evaluates how these threats have metastasized and traces the origins of modern security vectors to determine if established defensive protocols remain effective against increasingly complex modern exploitation tactics. We conducted a strict Systematic Literature Review (SLR) structured by PRISMA 2020 guidelines, filtering an extensive initial pool of 885 records down to 62 core sources published between 2015 and 2026. This foundational dataset synthesizes observations from 44 peer-reviewed empirical studies alongside analysis from 18 key cybersecurity frameworks and official threat intelligence reports, incorporating guidance from standards bodies including OWASP, NIST, and ISO/IEC. The synthesized evidence reveals a definitive and strategic maturation in adversarial approach: threat actors are abandoning isolated, single-vulnerability exploits. They are instead executing prolonged, multi-stage campaigns that specifically leverage the trust relationships found in interconnected software ecosystems. While SQLi, XSS, and authentication weaknesses remain critical and frequent (identified within our 12 primary attack categories), a steep rise in complex, multi-stage exploit chains, AI-assisted reconnaissance, API breaches, and software supply chain compromises represents the new operational normal for adversaries. Furthermore, our analysis indicates that traditional defensive frameworks like secure development lifecycles, Zero Trust Architecture, DevSecOps, and Web Application Firewalls (WAFs) are no longer sufficient in isolation. Their mitigation capacity works only when supported by continuous, real-time context-aware monitoring and truly dynamic risk management, establishing an empirical baseline for architecting resilient security posturing that can keep pace with accelerating innovation.
Irene I. Eda, Jose Marcelito D. Brigoli, Teodoro B. Comayas Jr. et al.· Iconic research and engineer...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
