AgentTell: Behavioural Side-Channel Leakage in Browser-Use Agents

arXiv:2609.32915 · cs.CR, cs.AI · Submitted 2026-09-26 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-26

Updated: 2026-09-26

Code: https://github.com/kagnlp/AgentTell

Terminology

• Benchmark — 20× in this paper · explained in 2 episodes
• Leakage Score — 16× in this paper
• AgentTell — 13× in this paper · explained in 1 episode
• Trace — 13× in this paper · explained in 2 episodes
• Benchmarking — 6× in this paper · explained in 3 episodes
• International Conference on Learning Representations — 4× in this paper
• Verification — 4× in this paper · explained in 2 episodes
• Generative AI — 3× in this paper · explained in 2 episodes
• Reinforcement Learning — 2× in this paper · explained in 4 episodes
• SIGSAC Conference on Computer and Communications Security — 2× in this paper
• Steering — 2× in this paper · explained in 2 episodes
• Accountability — 1× in this paper · explained in 2 episodes
• Accuracy — 1× in this paper · explained in 1 episode
• Action Space — 1× in this paper · explained in 1 episode
• Adam — 1× in this paper · explained in 2 episodes
• Adversarial Robustness — 1× in this paper · explained in 3 episodes
• Equal Task Completability — 1× in this paper
• Multimodal Reasoning — 1× in this paper · explained in 5 episodes
• Reasoning Traces — 1× in this paper · explained in 3 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Robustness — 1× in this paper · explained in 5 episodes

Sources

• Qwen3-VL Technical Report
• CI-Bench: Benchmarking Contextual Integrity of AI Assistants on Synthetic Data
• DECEPTICON: How Dark Patterns Manipulate Web Agents
• Defeating Prompt Injections by Design
• Network-Level Prompt and Trait Leakage in Local Research Agents
• The BrowserGym Ecosystem for Web Agent Research
• Ignore Previous Prompt: Attack Techniques For Language Models
• SPILLage: Agentic Oversharing on the Web
• Privacy Practices of Browser Agents
• GLM-4.5V and GLM-4.1V-Thinking: Towards Versatile Multimodal Reasoning with Scalable Reinforcement Learning
• The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
• Same-Origin Policy for Agentic Browsers
• WIPI: A New Web Threat for LLM-Driven Web Agents
• WebArena: A Realistic Web Environment for Building Autonomous Agents

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs