Most web vulnerabilities stay exploitable via AI agents; interface design drives risk
The claim
AI-mediated access leaves 91% of tested web vulnerabilities exploitable, with interface restrictions being the primary factor
Published as: “The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation”
So what
Designing agent-facing capabilities-especially limiting exposed operations and argument domains-is the primary lever to reduce exposure of existing web vulnerabilities.
The five-minute version
In the reference configuration, 91% of the 44 tested vulnerabilities remain exploitable when mediated by an AI agent, showing that the agent adds little protection beyond what the interface permits. Changing the capability design shifts exploitability dramatically, from 95% retention with an endpoint-oriented interface down to 39% with a query-oriented one, while the choice of agent only moves retention by up to 4.5 percentage points. The evidence comes from an executable benchmark (Vela) that reproduces real and deliberately vulnerable web apps, uses independent oracles, and compares native access, direct interface calls, and agent-mediated execution across three commercial LLM agents.
What they found 4
- 91% of vulnerabilities remain exploitable under the reference interface design.
“so exploitability is set mainly by the interface: 91% of vulnerabilities remain exploitable under the reference design.”
- Retention is 91% of all native cases and 100% of the expressible subset.
“Retention is therefore 91% of all native cases and 100% of the expressible subset.”
- Interface design changes retention by up to 56.8 percentage points, far more than agent choice.
“The design thus moves retention by 56.8 percentage points, against at most 4.5 across agents, but narrowing the surface removes exploit paths and useful operations together.”
- In one case the agent completed an attack by supplying missing prerequisite calls.
“the agent looked up the order and initiated the return first, and the oracle verified the credit.”
What undercuts it the paper’s own results
- A query-oriented interface reduces retention to 39% and also lowers benign coverage to 46%, showing that restrictive interfaces can dramatically cut exploitability but at the cost of functionality.
- The agent can supply missing steps (step completion), potentially enabling attacks that the attacker did not specify.
Stated limits 3
- The benchmark covers 44 documented vulnerabilities across twelve application families, with cases drawn from production applications and deliberately vulnerable environments.
- We built the interfaces ourselves, so the 91% reference figure is not an estimate for deployed services.
- Observed exploitability depends on the tested requests, agent versions, and execution budgets.
What’s new here 4
- Provides Vela, an executable benchmark of 44 real and synthetic web vulnerabilities across twelve applications.
- Isolates the effect of the agent-facing interface from the agent's behavior by using a frozen capability design and matched evaluation.
- Measures exploitability under agent mediation with independent oracles, rather than relying on agent output.
- Quantifies how interface design, not agent choice, dominates the retention of exploitable vulnerabilities.
Threat model stated by the source
Artifacts & methods 8
- Vela benchmarksystem
- Claude Code agentsystem
- Codex agentsystem
- Grok Build agentsystem
- Endpoint-oriented capability designprimitive
- Workflow-oriented capability designprimitive
- Query-oriented capability designprimitive
- Independent oracles for confidentiality and integrityevaluation