WebTrap Farm — Paired usability calibration — What does it mean?

The news. On November 9, 2026, researchers from Fudan University and partner institutes posted "Harness Matters: Measuring and Dissecting Security Resilience in Web Agents" (arXiv 2611.11971). It introduces WebTrap Farm, a test bed for three attack types — malicious user prompts, prompt injection hidden in web pages, and deceptive website design — run against six open-source web-agent harnesses on seven backend models, plus the Claude and Gemini computer-use agents. Its central design choice is that every attack task ships with a benign twin, so a failed attack only counts as a defense when the agent could have done the underlying interaction. Read the paper →

Picture a bank running a mystery-shopper test on its tellers. A fake customer walks up with a forged withdrawal slip and leaves with nothing. Was that a good teller? You cannot tell yet: the teller may have spotted the forgery, or may simply not know how to work the till and be unable to pay out any withdrawal at all. The clean way to tell a catch from a teller who cannot work the till is to send an honest twin through the same withdrawal steps, minus the forgery. If the twin gets served, the refusal was judgment. If the twin also leaves with nothing, the bank learned nothing about fraud — it learned that this teller cannot pay anyone.

WebTrap Farm applies that rule to web agents. Each attack task — for example, a page that invites the agent to type a credit-card number into a field unrelated to the user's goal — is paired with a usability task that keeps the task-relevant interaction — the page, the form, the clicks — but swaps in a benign objective with no adversarial trigger. For structured web interactions, outcomes are scored from instrumented webpage events (clicks, downloads, permission grants, form submissions) rather than agent-specific logs, so closed commercial agents are scored the same way; open-ended text tasks use an LLM judge. Each attack then gets one of three labels, and capability failures are removed from the denominator of both the attack success rate (ASR) and the defense success rate (DSR), then reported separately as the task completion rate (TCR). This is the metric mismatch failure mode made concrete: an uncalibrated "attacks blocked" number partly measures how often the agent cannot finish anything.

Where the "blocked" number comes from

Take the two harnesses at the ends of the paper's capability-versus-security chart, using its numbers pooled across the seven backend models, rounded per 100 attack tasks. Agent-E completes the benign twin on 61% of tasks (TCR 61.33%) and, on those, avoids the unsafe action 79.76% of the time. Derived and rounded per 100 attack tasks, that is about 49 real defenses, 12 attack successes and 39 capability failures. An uncalibrated benchmark counts every non-success as blocked, so 49 + 39 = ~88% "blocked", against a calibrated DSR of 79.76%. Skyvern 2.0 completes 85% of benign twins (TCR 85.25%) with a DSR of 58.01%: derived the same way, about 49 defenses, 36 attack successes and 15 capability failures, so ~64% "blocked" uncalibrated. Both harnesses produce about the same 49 genuine defenses per 100 tasks; what separates them is 36 versus 12 completed attacks — and 39 tasks Agent-E could not do at all, which an uncalibrated score would credit as security. In the limit, a harness that cannot operate any page blocks 100% of attacks with a TCR of 0.

The harness, not only the model, decides

Calibration is what makes the paper's second finding trustworthy: web-agent security is a property of the model and the harness together, not of the model alone. Claude-Opus-4.5 is the backend most resistant to malicious user prompts in the study (3.25% ASR on that attack type), yet inside the Agent-E harness it defends 75.19% of capable attempts while GPT-4o defends 83.79%. Some unsafe actions need no attack text at all. On "naive" web-side tasks, where nothing adversarial is inserted into the page, SeeAct still completed the unsafe action 50.00% of the time (49.37% with explicit injection), and Browser Use (Text) 41.27% (36.30% with explicit deceptive content). The authors' reading of the logs: a phrase like "ignore previous instructions" can trip the model's safety training, but a credit-card field that simply appears in a course-selection flow carries no alarm, and the harness fills it because the page offers it. That is a harness with no check that an action is necessary and goal-consistent before it runs — the gap a defense-in-depth stack is meant to close, and the reason a page the agent reads is the untrusted-content leg of the lethal trifecta.

Where the defense actually happens

Because every defense is a calibrated one, the authors can ask which of the four harness stages above stopped each attack. The paper's stage metric is the conditional DSR: of the capable attempts that are still unstopped when they reach a stage, the share that this stage stops. Agent-E's LLM-based goal interpreter stops 82.71% of capable user-side attacks at goal interpretation, before any planning starts. Two prompt swaps on 100 sampled tasks, with GPT-4o fixed as the backend, show that this is a design property: giving Agent-E the less detailed goal-interpretation prompt from Skyvern 2.0 drops its stage-one conditional DSR from 75.61% to 53.85%, and removing the risk-awareness cues from Browser Use (Vision)'s reasoning prompt drops its stage-three conditional DSR from 73.91% to 43.48%. A planner prompt tuned only for task completion will reason about how to finish a malicious goal once that goal gets past the first stage.

The practical rule for anyone red-teaming their own agent: build the benign twin for every attack case, with the same page and the same form and the trigger removed, and publish the TCR next to the block rate. A block rate without its task completion rate is not a security number. It is the same discipline as keeping golden cases — a fixed reference the score is measured against — applied to the denominator.

Goes deeper in: AI Agents → Evals & Diagnostics → The 4 Eval Failure Modes

Related explainers

• RAG-Safety-Bench: benign-context safety degradation — the same move for retrieval: fix the documents so a weak retriever cannot pose as an unsafe generator.
• PACE: influence-path confinement — a check at the moment of the tool call, the kind of gate this paper finds missing at action execution.
• Harness component ablation — hold the agent loop fixed and move one component at a time, the method behind the prompt swaps above.