The VELA test bench replays 44 web vulnerabilities through three commercial agents. They carry out all possible attacks, and even completed one that the attacker had left unfinished.
More and more online services are exposing interfaces for AI agents, which call server functions directly instead of browsing the site. Researchers wanted to know if this detour by an agent changes anything to classic web flaws. Their testbed, VELA, stores 44 real vulnerabilities spread over twelve application families and adds interfaces for agents built from legitimate paths.
The agent does not stand in the way
The result: in the baseline configuration, all three sales agents tested perform all the attacks that a direct call to the interface would allow, and 91% of the vulnerabilities remain exploitable. No failures are due to agent rejection or input normalization; in one case, the agent even provided the missing calls on its own to complete the attack.
The decisive factor is the design of the interface: depending on the restrictions imposed, the share of exploitable vulnerabilities varies from 39% to 95%, while the choice of agent only moves it by 4.5 points at most. The authors warn, however, that the most restrictive interfaces also block legitimate uses, and that this trade-off must be thought out from the design stage.
Read the full article on the original source
Go to the source →