Web-Based IDPI in the Wild: When Webpages Become Agent Prompt Delivery

At an operator-controlled tool dispatcher, intersect authenticated subject, workload, registry and separately authorized task grants; enforce signed scope, expiry and atomic action budgets, including the G002 trusted-registry and external-audit wrapper. Untrusted content may narrow scope but cannot grant tools. This denies out-of-scope calls, not misuse of an already permitted tool or malicious answers within the allowed task. Every alternate execution path needs verified coverage; provider-managed runtime enforcement is not established by this mapping.

Unit 42's samples include URL-fragment tricks, payment links, and rendered links that can become outbound requests. URL normalization and allowlist filtering make every fetchable destination explicit before an agent follows, previews, or sends data to it.

Webpage text becomes dangerous at the moment it is assembled into an inference request. The system should validate the final prompt package, label fetched web content as untrusted data, reject instruction-shaped content from data channels, and fail closed when a page tries to rewrite developer instructions or role hierarchy.

The published bounded HTML routine removes executable/embedded elements and markup, returns gateway-owned provenance, and keeps the result in an untrusted data role. It does not compute CSS visibility, perform OCR, or universally sanitize SVG. Hidden/off-screen natural-language instructions can remain in the extracted text, and a trust label does not make the model ignore them. Independent admission, tool and destination controls still enforce the boundary.

At an operator-controlled ingress, G001 can apply a pinned, calibrated secondary classifier to the extracted page text actually admitted to the agent and emit a content-bound finding for task redirection, authority claims or privilege escalation. G001 does not parse DOM, perform OCR, compare rendered pages or decode every listed carrier. The currently non-initializing G002 example cannot be credited as a working universal decoder. A finding supplies evidence; a separate admission policy owns refusal. Plausible or concealed instructions can evade classification. Independently validate the complete classifier result and required category coverage before admission. The current G001 sample returns PASS/NO_FINDING for empty output, missing categories or NaN scores; treat those conditions as errors and refuse admission. This validation is an additional integration guard, not behavior already supplied by the published sample.

The high-impact examples rely on data or actions flowing to the wrong sink: payment URLs, external web destinations, backend databases, or prompt-leak outputs. Runtime values derived from web content should carry untrusted provenance, and high-sensitivity values should be blocked from outbound HTTP, payment, database-write, or disclosure sinks unless policy explicitly permits the transfer. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.

Only the separately deployed, unprivileged Q worker may read raw pages; a validating broker passes narrow domain-specific values to P under authenticated source/model/schema bindings. The published price-observation schema needs an independently tested adapter for another task. Typed free text can still carry malicious instructions and false facts. Verify process, credential and network separation, deny broker bypass and independently authorize every final action; managed runtimes require provider support.

Unauthorized transactions, data deletion, DoS commands, and ad-approval bypasses become visible when the agent tries to act. Tool-use monitoring should compare requested actions with the original user intent, page trust level, tool risk class, and recent prompt-injection signals before execution.

Before delivery, logging or tool handoff, scan the exact output fields for the formats and tenant-specific literals/patterns actually configured and verified. The published common-format sample covers cards, US SSNs and AWS access-key IDs; arbitrary system-prompt text needs a separate organization-specific rule or detector. Encoded, transformed or novel secrets can evade matching. This emits findings only; a separate sink gate owns withholding/redaction, including link and tool-request coverage.