Prismata: Confining cross-site prompt injection in web agents

Prismata is a defense mechanism designed to secure autonomous web agents against cross-site prompt injection attacks. These attacks exploit agents' interpretation of natural language, allowing malicious content to hijack tasks. Prismata enforces "contextual least privilege" by dynamically labeling page content and restricting agent capabilities, inspired by integrity models. It redacts content and limits agent actions without requiring developer annotations. Prismata significantly reduces attack success in various web agent attacks while maintaining utility for legitimate tasks.