Opens in a new tabSkip to content
Agent LighthouseAgent Lighthouse

    Searches the text of every published page. The evidence sources themselves are not in this index — search all of them on the trusted sources page.

    GitHub ↗
    Browse checks and page contents
    operability-safety/aria-layer-injection-scan

    Accessibility-Layer Injection Scan

    What it checks

    Audit the text that reaches an agent through the accessibility tree and non-visual attributes rather than through body copy: alt, aria-label, aria-labelledby targets, aria-description, title, placeholder, hidden input values, <option> labels, document title and og:* metadata. Flag instruction-shaped content, anomalously long values, and aria-label/visible-text divergence.

    Why it matters

    Computer-use and browser agents drive pages through the DOM and accessibility tree, not pixels, so a11y attributes enter the model context with the same weight as visible text while remaining invisible to a sighted human. Anthropic names the vector explicitly: ‘hidden malicious form fields in a webpage’s DOM invisible to humans, and other hard-to-catch injections such as through the URL text and tab title that only an agent might see.’ The divergence sub-check is a defect in its own right, independent of injection. An agent that clicks by accessible name will actuate an aria-label that contradicts the rendered label. Falsifier: if every a11y attribute is short, descriptive, and token-consistent with its element’s visible text, this channel carries no payload.

    Evidence

    • Piloting Claude for Chrome — Anthropic (vendor-doc, URL verified 2026-08-20)
    • Red-team attack success rate 23.6% in autonomous browsing mode, 11.2% after mitigations; a browser-specific challenge set went 35.7% -> 0%. Names the exact vectors: ‘hidden malicious form fields in a webpage’s Document Object Model (DOM) invisible to humans, and other hard-to-catch injections such as through the URL text and tab title that only an agent might see.’ This is the vendor-documented basis for auditing hidden inputs and a11y/metadata attributes.
    • Computer use tool — security and prompt injection guidance — Anthropic (vendor-doc, URL verified 2026-08-20)
    • ‘In some circumstances, Claude will follow commands found in content even when they conflict with your instructions. For example, instructions on webpages or contained in images might override your instructions.’ Classifiers run on screenshots to flag injections and force user confirmation. Also recommends asking a human to confirm consequential actions — the vendor-side counterpart to the site-side ‘don’t hide consequence behind a GET link’ check.
    • EIA: Environmental Injection Attack on Generalist Web Agents — arXiv / ICLR 2025 (study, URL verified 2026-08-20)
    • Injects content into the page environment that blends into the surrounding site. Up to 70% ASR for stealing specific PII, 16% for extracting the full user request, over 177 Mind2Web action steps. Authors report EIA is hard to detect and that well-adapted injections survive human inspection — i.e. detection has to be mechanical, not eyeballed.

    How it scores

    Tier per evidence policy: scored — grade A meets the A/B bar required for scored audits.

    Sources