WebVoyager — agentic threat model

Uses Large Multimodal Models (LMMs) to process both visual screenshots and text. This makes the agent highly vulnerable to indirect prompt injection via malicious web content, including adversarial images (visual prompt injection) and hidden text on target websites.

Not certain from the listing — No details are provided regarding data operations, vector databases, or training data. However, dynamically processing live web data poses risks of data poisoning if the agent caches or stores retrieved web content for future context.

Employs Set-of-Mark Prompting and self-healing automation to plan and execute actions. The primary threat is tool misuse, where the browser automation tool is manipulated by adversarial web elements into performing unintended actions like unauthorized form submissions or clicks.

Not certain from the listing — The deployment infrastructure and sandboxing mechanisms are not specified. If the browser automation runs without strict containerization, a compromised session could lead to local file access or remote code execution on the host.

Not certain from the listing — There is no mention of guardrails, logging, or observability features. Without real-time monitoring of the agent's browser actions, malicious or anomalous behaviors on third-party sites may go undetected.

Not certain from the listing — No security, compliance, or identity management controls are described. Operating on real-world websites implies the agent may handle sensitive user sessions or credentials, which requires robust encryption and access controls.

Not certain from the listing — The agent is described as a standalone web navigator with no explicit multi-agent or ecosystem integrations. The primary ecosystem risk would arise if other automated systems rely on WebVoyager's outputs without verification.