multiagentsecurity.ai AI cybersecurity research hub

Paper

The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation

Ruozhao Yang, Jiongchi Yu, Ming Hu, Xiaofei Xie

Published 2026-10-26

Actions

View source

Open PDF

Latest papers

arXiv preprint arXiv Prompt Injection Agent-to-Agent Communication Benchmarks and Evaluation

Venue: arXiv

Reviewer: The paper addresses security concerns in systems where AI agents mediate access to web services, examining how vulnerabilities can be exploited through such agent-mediated interfaces. This aligns well with the topic of multi-agent security research, including risks, attacks, and defense strategies in multi-agent environments. While the focus is more on agent-mediated access rather than multiple interacting AI agents per se, the investigation into attack surfaces, interface design, and agent behavior fits the requested research area sufficiently.

Abstract

Web services increasingly expose backend interfaces that let users delegate tasks to AI agents, which invoke service operations directly without navigating websites. This shift changes how existing Web vulnerabilities can be exploited. We investigate these changes through VELA, an executable benchmark covering 44 vulnerabilities across twelve Web application families. The benchmark preserves vulnerable backends and derives agent-facing interfaces from legitimate workflows. We evaluate three commercial agents across multiple interface configurations, using controlled comparisons to separate interface effects from agent behavior and independent oracles to verify attack outcomes. Our results show that the agent realizes every attack that direct interface invocation realizes in the reference configuration, so exploitability is set mainly by the interface: 91% of vulnerabilities remain exploitable under the reference design. Interface restrictions prevent some attacks by removing required operations or limiting input control, while retention remains high across vulnerability classes. No case-level loss in the reference configuration is attributed to agent refusal or input normalization, and in one case the agent completed an attack by supplying calls the attacker omitted. Across the tested configurations, interface design affects exploitability more than agent choice, moving retention from 39% to 95% against at most 4.5 points across agents, but some restrictive interfaces also limit legitimate workflows. Our study provides a systematic empirical account of how agent-mediated access reshapes existing Web vulnerabilities, grounding future Web architecture design in measured security outcomes and trade-offs between reducing attack exposure and preserving legitimate functionality in agent-facing services.

Summary

  • Web services increasingly expose backend interfaces for AI agents to perform tasks directly, altering traditional web vulnerability exploitation methods.
  • VELA benchmark evaluates 44 vulnerabilities across 12 web applications, assessing how agent-mediated access affects exploitability and legitimate functionality.
  • Results show 91% of vulnerabilities remain exploitable through AI-mediated interfaces, with interface design impacting exploitability more than the choice of AI agent.
  • Agent behavior does not mitigate exploitability; in certain cases, agents complete attacks by compensating for attacker-omitted steps, highlighting persistent security risks.
  • Three interface designs—endpoint-oriented, workflow-oriented, and query-oriented—differ in abstraction and significantly affect both attack retention and legitimate operation coverage.