Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

Researchers have introduced a stakeholder-centric benchmark to assess how web agents powered by large language models distribute harm when they fall victim to prompt-injection attacks, moving beyond conventional evaluations that focus solely on technical feasibility [1][2]. The benchmark, detailed in a paper submitted on 11 Jun 2026, is designed to systematically categorize and attribute harm across different affected entities such as users, sellers, and platforms [1][2]. Existing security evaluations adopt an attack-centric perspective, concentrating on whether an injection is technically possible while overlooking the nuanced distribution of resulting harms [2]. In practice, the researchers argue, prompt-injection risk is victim-dependent: a single exploit can produce asymmetric consequences for different stakeholders, and the same attack pattern may exhibit substantially different effectiveness depending on whom it targets [2]. The evaluation framework decomposes attacks into concrete objectives and applies complementary outcome- and process-level metrics [2]. Results reveal substantial and heterogeneous vulnerabilities across current agents. Not a single attack objective was reliably resisted, and failures distributed across qualitatively distinct modes [2]. These modes include stealthy parasitism, where an attack succeeds without disrupting the user's delegated task; misaligned disruption, where the task is disrupted without the attack succeeding; and compounded failure, in which both the adversarial objective and task integrity are simultaneously violated [2]. The findings highlight a gap in conventional evaluation methods, which miss these patterns of harm distribution [2]. The benchmark is publicly available on GitHub [2]. The work underscores the need for stakeholder-aware assessment as LLM-based agents are increasingly deployed in real-world environments where they operate over untrusted web content and execute actions with direct consequences [2].