An attacker that learns gets 20.36% attack success on web agents
Against 8 web agents, an attacker that learns from tries before won 20.36% of the time, against 15.24% for attacks that do not change.
Researchers made REEF, a set of 9 test websites for travel, stores, work and news. Web agents are AI tools that do tasks on websites without help. The team added ANGLER, an attacker that uses the results of tries before to make its lures work more frequently. Against 8 agents, ANGLER reached an attack success rate of 20.36%.
How it works
REEF pairs each task with a dangerous goal. It sends the goal with 5 attack types, at user level and at website level. Checkers read the condition of the site. A dangerous step counts only if it did occur. ANGLER keeps the near misses and changes them.
The numbers
- Adaptive attack success: 20.36%.
- Fixed attack success: 15.24%.
- Usual task success fell from 61.9% to 44.4% with attacks.
What is not known
The authors say that fixed tests give a low value for the risk. The paper gives no names for the 8 agents. It does not test a defense.
Insight: An attack success rate depends on the test
In October 2026, the WebMirage attack reached 91.9% on 6 models with image changes. This test gives 20.36% with adaptive lures on 8 agents. Each team picks its attack. The numbers do not compare, and a low rate can show a weak test. Also, attacks cut usual task success by 17.5 points. Leaders must tell vendors to name the attacks they tested and if the attacker adapted.
Sources
Posted
