Prismata Paper Reframes Web-Agent Prompt Injection As XSS

A new paper called Prismata treats AI web-agent prompt injection as a strain of cross-site scripting, per arXiv 2607.08147.

Its claim: mixing trusted and untrusted page content, then letting the model act on it, revives a bug class security spent fifteen years closing. That's the exposure for any product letting an agent read pages it doesn't control.

The sharper problem, per the paper: a security policy has to reason over the page's structure to work at all. It needs to be tight enough to block bad instructions and loose enough to let the agent finish its task. That structure is exactly what the attacker controls, so rewriting the page rewrites the policy meant to constrain it.

Prompt engineering doesn't close this gap. The fix is the one that ended XSS: a hard boundary between rendered content and executable instructions, enforced outside the model, not requested of it. Any agent framework still asking the LLM to police that boundary itself is betting it can out-reason whoever edited the page last. I wouldn't take that bet.