ArXiv researchers use web structure to stop agents being tricked

A team of researchers built a system that lets a browsing agent decide what a webpage element is by its structure. The agent reads the underlying markup. It checks whether an element is a real browser input or injected text, then acts on that finding. Agents can be manipulated by text on a page that pretends to be instructions. A browsing agent given access to your accounts will follow whatever text it reads, including text planted by an attacker. The fix the team proposes is structural. The agent checks the web document's own structure to verify what it is looking at before deciding what to do. The research ran against real webpages and showed a working approach to a genuine problem. For a product team shipping a browsing agent, this changes where the safety work sits. The agent does not rely on a human to catch manipulated pages. The agent reads structure to distinguish trusted inputs from untrusted text. That shifts how you design the moment where a human decides whether to grant the agent standing access to a site.