{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T06:58:58Z","timestamp":1782975538903,"version":"3.54.5"},"reference-count":62,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001381","name":"National Research Foundation, Singapore","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001381","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00025","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"436-455","source":"Crossref","is-referenced-by-count":0,"title":["WebCloak: Characterizing and Mitigating Threats From LLM-Driven Web Agents as Intelligent Scrapers"],"prefix":"10.1109","author":[{"given":"Xinfeng","family":"Li","sequence":"first","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tianze","family":"Qiu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yingbin","family":"Jin","sequence":"additional","affiliation":[{"name":"Hong Kong Polytechnic University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lixu","family":"Wang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hanqing","family":"Guo","sequence":"additional","affiliation":[{"name":"University of Hawaii at Manoa"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaojun","family":"Jia","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"XiaoFeng","family":"Wang","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Dong","sequence":"additional","affiliation":[{"name":"Nanyang Technological University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GPT-4o System Card","volume":"abs\/2410.21276","author":"Hurst","year":"2024","journal-title":"CoRR"},{"key":"ref2","volume-title":"Claude 3 Technical Overview","year":"2024"},{"key":"ref3","volume-title":"G. Deep Mind","year":"2024"},{"key":"ref4","volume-title":"Browser Use: Enable AI to control your browser","author":"M\u00fcller","year":"2024"},{"key":"ref5","article-title":"GPT-4V(ision) is a Generalist Web Agent, if Grounded","volume-title":"International Conference on Machine Learning","author":"Zheng"},{"key":"ref6","article-title":"A Survey of WebAgents: Towards Nextgeneration AI Agents for Web Automation with Large Foundation Models","volume":"abs\/2503.23350","author":"Ning","year":"2025","journal-title":"CoRR"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3627673.3680120"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1220"},{"key":"ref9","article-title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","volume-title":"International Conference on Learning Representations","author":"Zhou"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.371"},{"key":"ref11","article-title":"Advances and Challenges in Foundation Agents: From Brain-inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","volume":"abs\/2504.01990","author":"Liu","year":"2025","journal-title":"CoRR"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3711896.3736561"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3746027.3755643"},{"key":"ref14","article-title":"Eia: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","volume-title":"International Conference on Learning Representations","author":"Liao"},{"key":"ref15","article-title":"Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysis","volume":"abs\/2502.20383","author":"Chiang","year":"2025","journal-title":"CoRR"},{"key":"ref16","article-title":"WIPI: A New Web Threat for LLM-driven Web Agents","volume":"abs\/2402.16965","author":"Wu","year":"2024","journal-title":"CoRR"},{"key":"ref17","article-title":"AdvWeb: Controllable Black-box Attacks on VLM-powered Web Agents","volume":"abs\/2410.17401","author":"Xu","year":"2024","journal-title":"CoRR"},{"key":"ref18","article-title":"The Obvious Invisible Threat: LLM-powered GUI Agents\u2019 Vulnerability to Fineprint Injections","author":"Chen","year":"2025","journal-title":"arXiv preprint arXiv"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2636"},{"key":"ref21","volume-title":"Artificial Intelligence Web Crawlers Are Running Amok","author":"Allyn","year":"2024"},{"key":"ref23","article-title":"PhishDecloaker: Detecting CAPTCHA-cloaked Phishing Websites via Hybrid Visionbased Interactive Models","volume-title":"USENIX Security Symposium","author":"Teoh"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.5220\/0013171600003890"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.15849\/IJASCA.211128.11"},{"key":"ref26","first-page":"76","article-title":"Balancing Security and Privacy: Web Bot Detection, Privacy Challenges, and Regulatory Compliance under the GDPR and AI Act","volume":"5","author":"Llamas","year":"2025","journal-title":"Open Research Europe"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2014.7084331"},{"key":"ref28","volume-title":"What Is a Context Window?","author":"Bergmann","year":"2024"},{"key":"ref29","volume-title":"Python-Markdownify: Convert HTML to Markdown","year":"2025"},{"key":"ref30","volume-title":"Html2text","year":"2025"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1952"},{"key":"ref32","article-title":"Beautiful Soup Documentation","author":"Richardson","year":"2007","journal-title":"April"},{"key":"ref33","volume-title":"Selenium - Web Browser Automation","year":"2025"},{"key":"ref34","volume-title":"Web scraping with Python: Collecting more data from the modern web","author":"Mitchell","year":"2018"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/IEMECON56962.2023.10092327"},{"key":"ref36","volume-title":"Craw14AI: Open-source LLM Friendly Web Crawler & Scraper","year":"2024"},{"key":"ref37","volume-title":"Firecrawl","year":"2025"},{"key":"ref38","volume-title":"ScrapeGraphAI","year":"2023"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1002\/spe.2195"},{"key":"ref40","first-page":"76","article-title":"Crawling Based Data Collection and Data Pre-processing","volume-title":"Proceedings of 38th International Confer","volume":"91","author":"Morales"},{"key":"ref41","article-title":"LLM-powered GUI Agents in Phone Automation: Surveying Progress and Prospects","volume":"abs\/2504.19838","author":"Liu","year":"2025","journal-title":"CoRR"},{"key":"ref42","article-title":"GUI Agents with Foundation Models: A Comprehensive Survey","volume":"abs\/2411.04890","author":"Wang","year":"2024","journal-title":"CoRR"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3477142"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2013.444"},{"key":"ref45","volume-title":"The AI Browser Revolution: Rethinking Web Architecture","author":"Rieniets","year":"2025"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.870"},{"key":"ref48","article-title":"We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs","volume":"abs\/2406.10279","author":"Spracklen","year":"2024","journal-title":"CoRR"},{"key":"ref49","article-title":"A Real-world WebAgent with Planning, Long Context Understanding, and Program Synthesis","volume-title":"International Conference on Learning Representations","author":"Gur"},{"key":"ref50","article-title":"WebCanvas: Benchmarking Web Agents in Online Environments","volume":"abs\/2406.12373","author":"Pan","year":"2024","journal-title":"CoRR"},{"key":"ref51","article-title":"LLM Agents can Autonomously Hack Websites","volume":"abs\/2402.06664","author":"Fang","year":"2024","journal-title":"CoRR"},{"key":"ref52","article-title":"When LLMs Go Online: The Emerging Threat of Web-enabled LLMs","volume":"abs\/2410.14569","author":"Kim","year":"2024","journal-title":"CoRR"},{"key":"ref53","article-title":"EnvInjection: Environmental Prompt Injection Attack to Multi-modal Web Agents","volume":"abs\/2505.11717","author":"Wang","year":"2025","journal-title":"CoRR"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-naacl.363"},{"key":"ref55","article-title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","volume":"abs\/2504.18575","author":"Evtimov","year":"2025","journal-title":"CoRR"},{"key":"ref56","article-title":"Jailbreaking Leading Safety-aligned LLMs with Simple Adaptive Attacks","volume-title":"International Conference on Learning Representations","author":"Andriushchenko"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3540250.3549090"},{"key":"ref58","article-title":"Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks","volume":"abs\/2410.20911","author":"Pasquini","year":"2024","journal-title":"CoRR"},{"key":"ref59","volume-title":"Common crawl data"},{"key":"ref60","article-title":"A Technique for the Measurement of Attitudes","author":"Likert","year":"1932","journal-title":"Archives of psychology"},{"key":"ref62","volume-title":"Computer Use Demo Code","year":"2023"},{"key":"ref63","article-title":"UI-TARS: Pioneering Automated GUI Interaction with Native Agents","volume":"abs\/2501.12326","author":"Qin","year":"2025","journal-title":"CoRR"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1016\/j.autcon.2022.104141"},{"key":"ref65","volume-title":"Lighthouse"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/2212776.2223683"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573457.pdf?arnumber=11573457","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:27:31Z","timestamp":1782970051000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573457\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":62,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00025","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}