SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents

arXiv·high signal

Addresses the critical vulnerability where web agents that consume page screenshots can be attacked via visual prompt injection — malicious instructions embedded in webpage content that the agent's vision model interprets as commands. SnapGuard proposes a lightweight detection layer specifically for screenshot-based agents, filtering injected instructions before they reach the agent's action planner. With web agents proliferating (GPT-5.4's OSWorld-Verified at 75%, GPT-5.5 at 78.7%), this attack surface is growing fast and SnapGuard is among the first dedicated defenses.