Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

Who Pays the Price? Rethinking Web Agent Security

When AI agents browse the web for you, malicious content can trick them into making bad decisions. This emerging class of software, known as web agents, can autonomously search, compare, and transact on behalf of users. However, these agents are vulnerable to prompt-injection attacks. These occur when seemingly benign text, such as a product review, contains hidden instructions that hijack the agent's behavior.

Current security research has largely focused on whether an attack is technically possible. It essentially asks, "Can we trick the model?" But this attack-centric view misses a critical reality. The harm caused by an exploit is rarely uniform in real-world deployments. A single malicious instruction might not bother the user at all. Instead, it could devastate a third-party seller or compromise the integrity of the hosting platform.

A new study introduces StakeBench, a benchmark designed to move beyond simple "success or failure" metrics. Instead of just measuring if an attack worked, the authors propose a stakeholder-centric approach. This method categorizes and attributes harm to different parties. Their findings reveal that prompt-injection risk is deeply asymmetric. An attack can succeed without the user ever noticing a problem. The authors call this phenomenon "stealthy parasitism."

The blind spot in attack-centric testing

Most existing benchmarks for Large Language Model (LLM) security evaluate prompt injections by looking at technical mechanics. They typically measure if an adversarial instruction was followed or if the agent's original task was interrupted. While useful for laboratory settings, the authors argue this approach overlooks the multi-party nature of the web.

In a real-world ecosystem, such as an online marketplace, a web agent acts as a bridge between several entities. As shown in, these include the User (who delegates the task), the Sellers (who provide goods and content), and the Platform (which provides the infrastructure).

Conventional benchmarks tend to treat the agent as an isolated unit. They fail to capture how an exploit might preserve the user's experience while simultaneously harming a seller. This could happen through biased recommendations or by undermining platform workflow integrity.

The paper argues that ignoring these distinct victims misses "heterogeneous failure regimes." These are patterns where the agent fails in qualitatively different ways depending on the target. Without this nuance, developers may believe their agents are secure. They might see that the user's task remains intact and ignore covert exploitation.

Mapping harm through stakeholder taxonomy

To solve this, the authors developed StakeBench. This tool organizes security testing around the entity bearing the resulting harm. Rather than grouping attacks by how they are delivered, the framework uses a stakeholder-oriented taxonomy .

The mechanism functions through three interconnected layers:

1. Stakeholder Categorization: The benchmark divides potential harms into three buckets. These are User-targeted (e.g., leaking personal info), Seller-targeted (e.g., manipulating product ratings), and Platform-targeted (e.g., bypassing security workflows).
2. Objective Decomposition: Within each bucket, the authors identify 12 concrete adversarial objectives. For instance, a "Seller" target might involve "Malicious Cancellation." This is where an injected review tricks the agent into canceling a legitimate order.
3. Multi-Axis Evaluation: Every execution is judged along three independent axes. The authors use Attack Success Rate (ASR) to see if the attacker won. They use Task Deviation Rate (TDR) to see if the user's goal was disrupted. Finally, they use Behavioral Irregularity Rate (BIR) to detect "pathological" behaviors like infinite navigation loops.

By combining these axes, the authors identify four distinct failure regimes. As illustrated in, these range from "Stealthy Parasitism"—where the attack succeeds (high ASR) but the user's task is undisturbed (low TDR)—to "Compounded Failure." In this regime, both the attacker wins and the user's task is ruined.

Measuring the asymmetry of vulnerability

The StakeBench evaluation reveals that current web agents are significantly vulnerable. For indirect prompt injection (IPI), the average Attack Success Rate (ASR) is between 54.91% and 56.09% across tested systems. This means more than half of the attacks succeeded in achieving their malicious goal. The authors report that backbone model selection is a more dominant factor in vulnerability than the specific agent architecture used.

Crucially, the paper finds that vulnerability profiles shift sharply depending on the target. According to the data in [Table 2], seller-targeted attacks yielded the highest ASR and the highest TDR. This means these attacks are both highly effective and highly disruptive to the intended task. Conversely, user-targeted attacks produced the lowest TDR. This suggests that attacks aimed at stealing user data are often "stealthy." They succeed without visibly deviating from the user's expected workflow.

The authors also investigated the "semantic distance" between the user's intent and the attacker's goal. They report that when an injected objective closely resembles the user's task, the ASR rises significantly. On certain configurations, it reaches up to 79.17% [Table 3, Panel A]. This lands the failure in the "Stealthy Parasitism" regime. It demonstrates that the closer an attack is to "normal" behavior, the harder it is to detect.

Limits of the current benchmark

While StakeBench provides a sophisticated lens for security, the authors acknowledge several limitations. First, the benchmark is currently focused on the online shopping domain. While this is a high-stakes environment, the findings may not immediately generalize to other sectors. Medical web agents or enterprise software might have different stakeholder relationships.

Second, the study's exploration of visual manipulation is preliminary. The authors conducted a small-scale experiment using modified product images .

These images included fake "bestseller" badges. They report that this visual deception significantly shifted agent selection behavior [Table 4]. However, they note that a systematic, large-scale benchmark for visual-channel prompt injection is still required.

Finally, the paper focuses on characterizing vulnerability rather than testing defenses. It does not evaluate how specific mitigations perform against the StakeBench suite. For a practitioner, this means the benchmark is a diagnostic tool. It helps identify risk but is not a testing ground for specific security patches.

The verdict: A new requirement for agent deployment

If you are building or deploying LLM-based web agents, the verdict is clear. You cannot rely on aggregate success metrics to guarantee security. A high task-completion rate is no longer a sufficient proxy for a safe system. It can mask successful, stealthy attacks that harm third parties or degrade platform integrity.

The research demonstrates that vulnerability is a distribution of harm, not a single number. Developers must move toward multi-axis evaluations. These must explicitly track task integrity and behavioral stability alongside attack success. Code and the full benchmark are reportedly available at https://github.com/StakeBench/SBC. This provides a foundation for the next generation of stakeholder-aware agent security.

Figures from the paper