Autonomous web agents, designed to automate browsing tasks, face a significant security risk from cross-site prompt injection. This attack vector exploits the agent's interpretation of natural language instructions, allowing malicious third-party or user-generated content to hijack the agent's functionality. The complexity arises from the entanglement of page structure and attacker-controlled content, making it difficult to derive task-specific security policies.

Prismata, a new defense system, addresses this by enforcing contextual least privilege for web agents. It dynamically derives permission labels for page content based on structural integrity models. These labels ensure that privilege levels can only decrease, bounding potential mislabeling errors. The system then mechanically enforces these labels by redacting content and restricting agent capabilities.

A key advantage of Prismata is its ability to operate without requiring developer annotations, making it applicable to a wide range of websites. In evaluations against recent web agent attacks, including adaptive variants, Prismata significantly reduced attack success rates while maintaining the utility of benign agent tasks. This approach offers a practical solution for securing the growing domain of web agent automation.