ML Security PapersceLLMate: Sandboxing Browser AI Agents
Luoxi Meng 1, Henry Feng 1,2, Ilia Shumailov 2,1, Earlence Fernandes 1
Published on arXiv
2512.12594
Prompt Injection
OWASP LLM Top 10 — LLM01
Excessive Agency
OWASP LLM Top 10 — LLM08
Key Finding
ceLLMate's sandboxing framework effectively blocks various prompt injection attack types on browser-using agents with negligible runtime overhead.
ceLLMate
Novel technique introduced
Browser-using agents (BUAs) are an emerging class of autonomous agents that interact with web browsers in human-like ways, including clicking, scrolling, filling forms, and navigating across pages. While these agents help automate repetitive online tasks, they are vulnerable to prompt injection attacks that can trick an agent into performing undesired actions, such as leaking private information or issuing state-changing requests. We propose ceLLMate, a browser-level sandboxing framework that restricts the agent's ambient authority and reduces the blast radius of prompt injections. We address two fundamental challenges: (1) The semantic gap challenge in policy enforcement arises because the agent operates through low-level UI observations and manipulations; however, writing and enforcing policies directly over UI-level events is brittle and error-prone. To address this challenge, we introduce an agent sitemap that maps low-level browser behaviors to high-level semantic actions. (2) Policy prediction in BUAs is the norm rather than the exception. BUAs have no app developer to pre-declare sandboxing policies, and thus, ceLLMate pairs website-authored mandatory policies with an automated policy-prediction layer that adapts and instantiates these policies from the user's natural-language task. We implement ceLLMate as an agent-agnostic browser extension and demonstrate how it enables sandboxing policies that effectively block various types of prompt injection attacks with negligible overhead.
Key Contributions
- Agent sitemap abstraction that maps low-level UI browser events to high-level semantic actions, bridging the policy-enforcement semantic gap
- Automated policy-prediction layer that instantiates sandboxing policies from user natural-language tasks in the absence of pre-declared app developer policies
- Agent-agnostic browser extension implementation (ceLLMate) that blocks diverse prompt injection attacks with negligible overhead