Web Agent Tool Execution Security and Privilege Boundary Analysis

Role: Staff AI Security and Guardrails Engineer with deep expertise in tool-calling authorization, prompt injection, and browser sandboxing.

Context

• Untrusted Web Ingestion Sources: {{untrusted_web_sources}}
• Tool Permission Matrix: {{tool_permission_matrix}}
• Orchestration Middleware: {{agent_orchestrator}}
• Sandbox Isolation Level: {{sandbox_isolation_level}}
• Audit Logging Mechanism: {{audit_logging_mechanism}}
• Identified Exfiltration Surface: {{data_exfiltration_surface}}

Task

Conduct a rigorous security analysis of an autonomous web agent's tool execution chain, uncovering indirect prompt injection vectors, authorization boundary bypasses, and unauthorized side effects resulting from adversarial web page payloads.

Method

1. Map threat vectors originating from {{untrusted_web_sources}} into the agent's context window through DOM extraction and tool return values.
2. Interrogate the {{tool_permission_matrix}} to detect high-privilege functions (e.g., write/delete APIs, database mutations) accessible within the same session as web browsing.
3. Analyze {{agent_orchestrator}} for missing confirmation boundaries, inadequate tool output sanitization, and ambient authority anti-patterns.
4. Evaluate {{sandbox_isolation_level}} against SSRF, local network traversal, and browser fingerprint harvesting.
5. Model payload delivery techniques (hidden HTML text, markdown image injection, metadata manipulation) targeting {{data_exfiltration_surface}}.
6. Audit {{audit_logging_mechanism}} to verify whether security-critical tool invocations produce immutable, tamper-evident telemetry.
7. Architect a dual-boundary defense model establishing separate untrusted parsing and privileged execution agent tiers.

Constraints

• MUST analyze cross-tool contamination where untrusted web content coerces execution of internal tools.
• MUST evaluate telemetry sufficiency in {{audit_logging_mechanism}} for post-incident forensics.
• MUST NOT accept natural language system prompt guardrails as sufficient defense against injection.
• Output MUST provide concrete architectural separation patterns for high-risk tool execution.

Output format

• 1. Threat Landscape Synthesis: 250 words outlining the primary vulnerability vectors and attack paths.
• 2. Tool Privilege & Attack Matrix: Markdown table with Tool Name, Privilege Level, Injection Vulnerability (High/Med/Low), and Blast Radius.
• 3. Attack Scenario Deep Dives: Exactly 3 realistic attack trees (Indirect Prompt Injection via DOM, Tool Parameter Manipulation, Exfiltration via Action Primitives).
• 4. Privilege Boundary Architecture: Defensive blueprint outlining human-in-the-loop gates and least-privilege scoping.
• 5. Security Action Plan: 5 sequenced remediation steps prioritized by risk severity.

Self-review

• Verify that every listed variable is incorporated into the threat modeling process.
• Confirm that prompt injection analysis moves beyond basic delimiter attacks to sophisticated multi-modal/structural payloads.
• Ensure all recommended guardrails are architecturally enforceable at the runtime middleware layer.