# MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents

Source: [MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents](<https://www.sota2.com/research/paper/6a3a1309206542251d7c6f2a>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-06-24T05:00:04.550Z

Authors: Xuelong Dai, Jianyu Ma, Boyang Ma, Biwei Yan, Yijun Yang, Yue Zhang

Published: 2026-06-16T15:31:33.000Z

## Abstract

Multimodal Large Language Model (MLLM)-based web agents provide practical, high-precision solutions for visual browser automation; however, they inherently expand the attack surface, introducing novel vision-based vulnerabilities. Existing adversarial evaluations targeting these agents frequently rely on permissive threat models and visually conspicuous artifacts. In this paper, we investigate a constrained vulnerability detection setting: a trusted web platform where the evaluator acts solely as an unprivileged third party, such as a merchant or advertiser, controlling only a semantically legitimate, spatially constrained region, such as an ad slot, a sponsored card, or a localized widget. Operating under these realistic constraints, we propose MIRAGE, a novel visual indirect prompt injection framework for targeted next-action hijacking. Our approach leverages diffusion models to generate perceptually benign adversarial images strictly confined to the attacker-controlled boundaries permitted by the trusted service provider. To maximize attack efficacy within such a restrictive setting, we introduce a robust optimization technique combining curvature-aware adversarial diffusion guidance with sparse, dark-pixel residual perturbations. Comprehensive evaluations against prominent MLLM web agent frameworks, specifically SeeAct and OpenClaw, empirically demonstrate the potency, realism, and stealth of our proposed MIRAGE.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Web Agent Attack on SeeAct](<https://www.sota2.com/research/sota/web-agent-attack-on-seeact.md>): Web agent attack; SeeAct; ASR1: 98.3.

- [Web Agent Attack on OpenClaw](<https://www.sota2.com/research/sota/web-agent-attack-on-openclaw.md>): Web agent attack; OpenClaw; ASR: 98.5.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2606.20717>)

[PDF](<https://arxiv.org/pdf/2606.20717.pdf>)