The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named

Abstract

A browser agent that works in its user's signed-in session can be steered by a two-sentence note on a page it reads into approving a third party's access to the user's account. The agent is a confused deputy: the session supplies the authority, the page designates the access request to approve or the webhook URL to register, and nothing at the point of action checks one against the other. The agent thereby supplies the approval click that a consent screen reserves for the account holder. We measure this failure on two authorization surfaces, an OAuth-style access grant and a webhook registration, with agents built on an open-source browser framework and models from two providers. Without a defense the unauthorized action completed in all 73 attack runs. An instruction telling the model that only the user's task authorizes a grant still left 7 of 10 consent attacks completing. We therefore move the check to where the action completes. The authority envelope gate has the service accept a request only when it matches the task's envelope, the client and account or the webhook URL that the user's task named, fixed before the agent starts. With the gate the agent still sent the request in every one of 70 attack runs, the service rejected each, and the action completed in every control run whose task named it. A service that receives the task's envelope should therefore check agent-driven authorization requests against it.