Three Patterns Defeat an Action Ladder: What a Detection-Independent Gate for a Browser Agent Does and Does Not Contain

Abstract

Browser agents act inside the user's authenticated session, so a page that smuggles instructions into its own content can borrow the user's authority. The common defence is to detect the malicious text. We built the complementary thing — a gate that never reads content and classifies each browser tool call by what the call can do — installed it in front of a shipping product's tool surface, and measured where it fails. Three realization patterns defeat it, and between them they cover every one of 63 attacker goals in the InjecAgent corpus. Two of the three are declared scope rather than defects: reading an authenticated page is what a browser agent is for, and three independent reviewers unanimously said so when asked to refute our own findings. The third is real — a form that commits on input, with no click to gate. The reviewers then found five channels we had missed, the sharpest being that a screenshot of an authenticated page can be dropped onto an upload widget on the attacker's own page with no gated call anywhere. A second adversarial round, run against the paper rather than the gate, found that our fix had introduced a worse hole than the one it closed; a third round found that our fix for that was itself incomplete. Twice in a row, a fix written in response to a finding carried a hole of the same class as the one it closed. That is the most useful result here, and it generalizes past this artifact: a fix authored in response to a finding needs the same adversarial pass as the thing it fixes. What survives is a bounded property stated formally as Mediated Effect Confinement, whose strength equals the proposition that the allow tier is effect-free — an assumption about tool semantics that the gate does not enforce and that does not currently hold. The usability cost is real but modest: on allowlisted work the ladder is nearly free, while open-web browsing costs one prompt per new host, and 85.7% of benign calls proceed silently. We publish the residual attack surface, the deviations from our registration, and the reviewer records, because a defence paper that reports only what it survived is not evidence. AI co-observer disclosure: Claude Opus 4.8 (Anthropic) was used as a working method only, including as the adversarial reviewers described in the paper; the registered author is the human author alone.