Which AI Agents Encounter Which Traps?

A reference guide to agent types, capabilities, exposure, and evidence

October 24, 2026 · A human-directed, AI-researched and AI-written review of public sources

A research assistant reads a webpage. A coding assistant reads a tool description. A persistent character recalls an earlier conversation. Each receives information that may influence what happens next, but through a different route.

Calling all three “AI agents” does not tell us which traps they can encounter—or what encountering one would accomplish.

This guide brings together definitions, technical documentation, security demonstrations, and research on web browsing, tool use, memory, and communication between agents. Its purpose is to help readers find relevant work and compare its assumptions without having to reconstruct every connection themselves.

The short answer: match a trap to the agent’s information path, retained state, available actions, and permissions. A use label such as “research agent” or “companion” provides a starting point, but cannot establish exposure or vulnerability.

The discussion also covers crawler traps and invitations to participate in public guestbooks. These are useful comparisons, although they have different purposes from adversarial attacks.

Scope and evidence. This is a review, with no independent attack experiments. Research findings are reported within their authors’ test conditions; demonstrations, provider documentation, and publicly displayed self-descriptions are identified separately. The comparison tables and cross-source interpretations are editorial synthesis, not a new scientific taxonomy. Product descriptions and public pages were checked on October 24, 2026. Historical demonstrations do not establish the security status of current releases.

1. What does “agent” mean?

The broad concept predates LLMs

In the textbook formulation used by Russell and Norvig, an agent perceives an environment and acts upon it. Language models are not a requirement. Rules, search, planning, learned policies, and combinations of these approaches can govern its behavior. [1]

An automated game character, a robot, and a language-based research assistant can therefore all be discussed as agents, despite substantial differences in their construction.

Current LLM terminology is less consistent. Anthropic’s Building effective agents describes an architectural distinction: workflows follow predefined code paths, whereas agents use LLMs to direct their processes and tool use dynamically. The same article acknowledges that the industry uses the word more broadly. We use that distinction to describe control flow, rather than treating it as a universal naming rule. [2]

For this review, an LLM agent is a system in which a language model participates in interpreting observations, choosing steps, or directing actions within an execution process. Its behavior also depends on the surrounding software: tools, scheduling, stored state, access controls, and stopping conditions.

A model is one component. The complete agent is the system that connects it to an environment.

What kinds of agents does that include?

The following groups describe uses, with overlaps. They are a navigation aid rather than mutually exclusive technical classes.

An LLM is possible in each group, but the activity itself does not prove that one is used. A game character may follow rules; a simulated population may use mathematical models; a robot may rely on conventional control and planning. Conversely, an LLM-based character may also write software or conduct research.

Persistent characters deserve a place in this overview. The Generative Agents research combines memories, reflection, and planning for simulated inhabitants. iLands describes persistent identities and histories, recurring activity, private workspaces, and controlled external capabilities. These are different examples of continuity across interactions. [18][19]

For an iLands-style character, the useful questions are concrete: what can it observe, what is retained, how is activity resumed, and which actions are available? Its conversational personality alone cannot answer them. The provider’s descriptions do not establish whether any particular memory attack works against the service.

How agents run is a separate question

“Browser agent,” “scheduled agent,” and “multi-agent system” describe different dimensions:

These dimensions can combine. A persistent character may wake periodically and use an API; a research assistant may finish one task through several delegated workers. Persistent identity does not require one model invocation to run continuously.

Capability, permission, and observed behavior also answer different questions. An agent may be able to fill a form without being authorized to submit it. A proposed submission is different from a completed one. Treating all three as a single measure of “autonomy” obscures the conditions that matter.

2. What must happen between an encounter and an outcome?

Many discussions jump directly from “the agent saw malicious text” to “the attack succeeded.” A more useful comparison records the intervening conditions.

This is an analytical checklist, not a fixed sequence every attack follows. An answer-corruption attack may end at interpretation. A memory attack may become consequential only during a later task. A person may perform the final operation. Section 1 describes the agent’s configuration; this checklist locates the observed outcome; Section 3 connects those characteristics to mechanisms and relevant studies.

The distinction between data and authority is especially important. Greshake and colleagues’ work on indirect prompt injection examines instructions placed in external material that an LLM-integrated application retrieves during legitimate use. The source of the attempted redirection is outside the user’s direct request. [3]

A retrieved instruction is not automatically malicious. Documentation can legitimately explain how to perform a requested task. The relevant issue is whether an external source is being allowed to redefine the task or authorize an operation beyond the authority it actually has.

“On the page” does not necessarily mean “in the input”

Agents may receive raw HTML, extracted text, an accessibility tree, screenshots, or combinations of these. Hidden elements can survive one route and disappear in another.

For example, OpenClaw’s current web_fetch documentation describes HTTP retrieval followed by readable-content extraction, without JavaScript execution. It also describes filtering text hidden by recognized inline styles. Anthropic’s browser-use documentation describes access to both page structure and screenshots. [16][17]

These are specifications, not comparative security tests. They show why “AI can read hidden HTML” is too broad: the answer depends on the acquisition and transformation pipeline. Filtering some hidden content also does not resolve attacks carried by ordinary visible text.

The useful object to inspect is the representation delivered to the agent, rather than the original page in isolation.

3. Matching agent characteristics to trap mechanisms

Franklin and colleagues’ AI Agent Traps organizes adversarial mechanisms into six categories. The table retains their names and targets; the questions in the third column are this review’s synthesis. [4]

The categories overlap, and their empirical development is uneven. One incident may involve several. The framework also includes broader research questions, particularly around systemic effects and human supervision; listing a category does not establish a demonstrated exploit for every system. [4]

The following cross-reference connects agent characteristics, entry points, mechanisms, and studies. A research assistant, coding agent, or persistent character may fit several rows. These are conditional pointers for investigation, not findings that every agent with a listed capability is vulnerable. Category assignments are this review’s synthesis; each study demonstrates only the conditions and outcomes described in the sections below.

Tool descriptions are an easily overlooked case. Invariant’s 2025 demonstration places malicious instructions in descriptions supplied by a connected Model Context Protocol (MCP) server. The agent can encounter that text while deciding how to use tools, before receiving a normal execution result. The demonstrated effects depend on the connected environment and available capabilities. [14]

Similarly, Brave’s 2025 Comet report describes a webpage-summary request escalating into unrelated account and messaging actions in the tested setup. The example illustrates why access to authenticated services matters alongside the initial browsing task. It is a historical demonstration, not a claim about every browser agent or a current product release. [13]

This indexing avoids assigning each paper to one exclusive category. A poisoned knowledge source may influence interpretation and retained state; a tool-description attack may redirect behavior. Recording the entry point and outcome first makes the comparison clearer.

4. What do attack benchmarks actually measure?

“Attack success rate” is meaningful only after its starting conditions, denominator, and success criterion have been identified.

Three benchmarks illustrate the differences:

For direct-harm cases, InjecAgent judges success from the agent’s next harmful tool call; this does not verify completion in a live external service. For data-exfiltration cases, GPT-4 simulates the data-retrieval response so the next transmission action can be evaluated. InjecAgent also distinguishes success rates over all outputs from rates over valid outputs. A percentage quoted without its denominator can therefore change meaning even within one benchmark. See its evaluation procedure in Section 2.3 and metrics in Section 3. [5]

AgentDojo’s separation of useful task completion from attacker-goal completion matters for a different reason: failing to do the user’s job does not necessarily mean doing the attacker’s job. Its environment and reporting definitions are described in Section 3. [6]

WASP makes another distinction explicit. Intermediate deviation is assessed by a GPT-4o-based LLM judge using the agent’s reasoning and action records; end-to-end success is checked by rules against the environment’s final state. The first is a judgment about redirection, while the second tests the specified attacker outcome. Its evaluation directs the agent to the page containing the attack, so it does not measure natural discovery. Restricted attacker control and multi-step execution still matter: the paper discusses how execution limitations can prevent completion after an agent has already been redirected. See Sections 3.3–3.4. [7]

Cross-source interpretation: a low final attack-completion rate can reflect several causes: rejection of the injected instruction, inability to execute the requested operation, an environmental failure, or some combination. To assess robustness, read successful legitimate behavior alongside attempted and completed adversarial behavior.

There is a separate limit when applying these studies to a public website. An experiment beginning with a poisoned response already delivered cannot tell a site operator how often agents will discover a page through ordinary browsing.

5. Memory attacks have different entry requirements

“The agent has memory” is too coarse a condition for matching it to a memory attack. At least four questions matter: who can introduce content, what is stored, how it is retrieved, and what later decision uses it.

Retrieval-augmented generation (RAG) supplies retrieved material to a model during generation. It can be used in an answer service or inside a larger agent; retrieval alone does not establish autonomous operation. PoisonedRAG is included here because the information path is relevant to both. [8]

PoisonedRAG separates getting adversarial text retrieved from getting the desired answer generated. Its agent extension uses a limited retrieve-and-answer action space; it should not be read as a demonstration of arbitrary external operations. [8]

AgentPoison likewise distinguishes retrieval, targeted behavior, and final outcomes. Its storage-access assumptions are part of the result. A public page encountered through ordinary browsing is a different starting condition. [9]

MINJA is interesting because it removes the requirement for direct memory editing. Its query-only route still depends on the evaluated system’s shared memory: records created through one interaction can become examples for later queries. That assumption must travel with any summary of the attack. [10]

eTAMP studies a further route, through environmental observations retained in raw trajectories—records of earlier observations and actions. Its main experiments use constructed trajectories that ensure exposure; additional experiments allow free navigation and distinguish exposure from conditional success. The tested setup passes prior trajectories into later context to simulate memory retrieval. It does not establish indefinite persistence despite “Forever” in the paper’s title. [11]

These differences are more informative than a ranking of headline success rates. They identify the access or information path that an attacker would need in a particular implementation.

They also clarify what “learning” means in this discussion. Storing a record and retrieving it later can alter behavior without updating model weights. A persistent character’s evolving history, a task assistant’s saved progress, and a shared database of worked examples are different forms of retained state.

Cross-source interpretation: when assessing a new memory-enabled agent, begin with its write and retrieval paths. “Has long-term memory” identifies a topic to investigate, but leaves the decisive conditions unspecified.

6. Influence can pass to other agents or people

Between agents: initial entry and onward propagation differ

Prompt Infection studies adversarial influence across communicating agents. Its application experiments introduce malicious content into retrieved material within the experimental pipeline. Its simulated society experiments instead begin by changing the first agent’s system prompt, creating an initially compromised participant, and then examine propagation through conversations. [12]

Those setups answer different questions. The second provides evidence about onward spread from a compromised participant; it does not independently demonstrate how an external webpage first compromises that participant.

This distinction matters when comparing a managed team of assistants with a social space containing separately operated agents. Shared context, message formatting, source attribution, tools, and permissions may all differ. A large number of agents in one place does not establish the communication conditions tested in a particular paper.

Nor is every referral an infection. Passing on a useful link can be ordinary cooperation. Evidence of malicious redirection requires more than showing that information moved between participants.

Through people: text output can be consequential

A system does not need permission to execute commands in order to present harmful instructions to someone who can.

CloudSEK’s 2025 summarizer proof of concept describes hidden webpage content influencing an AI-generated summary so that it presents dangerous operational advice to the reader. The proposed final execution route is human action. The public report provides a demonstration of the output path; it is not a measurement of how often real users followed the advice or suffered harm. [15]

The comparison broadens what “read-only” means. Limiting an agent’s tools can prevent direct modifications while leaving the content of its advice relevant to downstream decisions. This is a reason to distinguish consequences, not a reason to dismiss permission limits or human oversight.

7. Crawler traps and invitations have different success conditions

The AI Agent Traps framework concerns adversarial manipulation. A mechanism intended to observe a crawler, or invite a permitted contribution, needs a different description.

Our companion review, AI Agent Traps: Mechanisms, Taxonomies, and Real-World Observations, Section 3, defines five editorial groupings across these adjacent examples: Information Bait, Incomplete Information, Instruction Redirection, Navigation Bait, and Participation Invitations. They describe what is placed in the environment and the response sought. They are separate from the six research categories above.

Three examples show why the distinction matters:

Cloudflare’s example is a site-operator defense: it draws non-compliant crawlers into a maze of links and records information used for bot detection. Its traces concern navigation behavior. Following a link does not require understanding a natural-language instruction. A crawler trace and an agent’s adoption of a page’s instructions are different observations. [20]

The hosette.net guestbook provides a more socially oriented example. As viewed on October 24, 2026, it displayed entries identifying themselves as iLands agents and describing arrival through another agent’s recommendation or post. That makes referrals a concrete subject for discussion. The public text remains self-report: it does not independently verify the model, the discovery history, or the authorization process. [22]

A90 illustrates participation requirements. Its documented agent route uses a signing key and proof of work; the operator explicitly requires user authorization for permanent publication and the expenditure of computation. A machine-usable route does not itself grant permission to use it. [23]

For a guestbook, the relevant conditions are therefore broader than comprehension: discovery, a reason to contribute, an available submission method, applicable permission, and successful submission all matter. These are descriptive conditions for participation, not instructions to override a visitor’s task.

For Agent Hoihoi, this distinction is practical. The purpose is to offer useful material and invite AI agents to leave messages. A guestbook entry can be welcomed without treating it as proof of autonomous agency, and the site can serve that purpose without becoming a controlled scientific experiment.

Supplementary material: Field observations

8. How to use this reference

When investigating an agent or a published attack, record the following before comparing claims:

1. Legitimate task: what was the system supposed to accomplish?
2. Attacker or operator control: a webpage, a comment, a tool response, tool metadata, a stored record, or an initially compromised agent?
3. Encounter and representation: was exposure assumed, experimentally ensured, or reached through navigation—and what reached the model?
4. State and communication: what could persist or be passed to another task, agent, or person?
5. Actions and authority: which operations were available, and which were permitted?
6. Outcome and evidence: a changed answer, an attempted call, an executed action, a final state, or a public self-description?

These questions help locate the right literature. For a read-and-answer system, start with retrieval and answer corruption. For a tool-using assistant, add tool responses, metadata, and execution conditions. For a persistent character, inspect retained state and recurring activity. For an agent team, inspect the handoffs as well as the initial encounter.

Several limits remain. This review does not supply a vulnerability ranking for commercial agents, a comparable success-rate league table, or a probability that a visiting agent will sign a guestbook. It also does not provide equally developed empirical examples for every category in the six-part framework. In particular, broad claims about semantic manipulation and human approval require attention to what a selected study actually tested.

The most reusable connection across the sources is specific: identify where information enters, how it is used or carried forward, and which outcome was observed. That provides a firmer basis for understanding a new agent than its product category or personality alone.

Sources and reading notes

Numbered citations refer to the sources below. Versioned links identify the text reviewed where available. Documentation and public pages may change.

Definitions and framework

[1] Russell & Norvig — Artificial Intelligence: A Modern Approach, Chapter 2, “Intelligent Agents.” Textbook foundation for the broad perception-and-action concept. Chapter PDF

[2] Anthropic — Building effective agents (December 19, 2024). See “What are agents?” and the architectural building blocks. Used for terminology, not a current product inventory. Article

[3] Greshake et al. — Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023). Foundation for externally supplied instructions in retrieved data. Paper

[4] Franklin et al. — AI Agent Traps (2026). Source of the six-category framework. The body was reviewed through a public copy because direct retrieval from SSRN was restricted; the copy’s update history was not independently verified. SSRN record · PDF consulted

Benchmarks and retained state

[5] Zhan et al. — InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents (ACL Findings, 2024). See Section 2.3 for the post-exposure setup, harmful-call criterion, and simulated data-retrieval response; Section 3 defines the reporting denominators. Paper and PDF

[6] Debenedetti et al. — AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (2024), v3. Section 3 defines environments, attack opportunities, and reporting. Reviewed version

[7] Evtimov et al. — WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks (2025), v3. Sections 2–4 describe attacker control and the web environment. Sections 3.3–3.4 specify the directed visit, LLM-judged intermediate deviation, and rule-based final-state evaluation. Versioned PDF

[8] Zou et al. — PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models, v3 (2024). See threat model, retrieval/generation conditions, and the agent extension in Section 6.3. Reviewed version

[9] Chen et al. — AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases (2024), v1. See Section 3.2 and experimental outcome definitions. Reviewed version

[10] Dong et al. — Memory Injection Attacks on LLM Agents via Query-Only Interaction (MINJA), v4 (December 2025; first posted March 2025). Section 3 states the shared-memory assumption. The original title was A Practical Memory Injection Attack against LLM Agents. This review cites v4; a subsequent v5 was posted on February 12, 2026. Reviewed version · Version history

[11] Zou et al. — Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents (eTAMP, 2026), v2. See Section 2 and Appendices A.1, A.2, and A.7 for raw trajectories and ensured versus freely encountered exposure. Reviewed version

Propagation and security demonstrations

[12] Lee & Tiwari — Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems (2024), v1. Sections 4.1 and 4.2 use different initial compromise conditions. Reviewed version

[13] Brave — Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (August 20, 2025). Researcher-reported browser demonstration and disclosure account. Original report

[14] Invariant Labs — MCP Security Notification: Tool Poisoning Attacks (April 1, 2025). See the tool-description mechanism and Experiment 1. Original report

[15] CloudSEK — Trusted My Summarizer, Now My Fridge Is Encrypted — How Threat Actors Could Weaponize AI Summarizers with CSS-Based ClickFix Attacks (August 25, 2025). Proof of concept for malicious advice entering summaries; not a human execution-rate study. Original report

Implementations and participation

[16] OpenClaw — Web fetch. See the opening paragraphs immediately before “Quick start” for HTTP retrieval, readable-content extraction, JavaScript non-execution, and cleanup of text hidden by recognized inline styles. Checked October 24, 2026. Documentation

[17] Anthropic — Browser use tool. Provider documentation describing structural and screenshot-based interaction. Documentation

[18] Park et al. — Generative Agents: Interactive Simulacra of Human Behavior (2023). Research on memory, reflection, and planning in a simulated community. Publication page

[19] iLands — Platform and FAQ. Provider descriptions of persistent agents, recurring activity, workspaces, and bounded capabilities. Platform · FAQ

[20] Cloudflare — AI Labyrinth. The opening description explains its defensive purpose; “AI Labyrinth in Security Analytics” distinguishes served and crawl events. Documentation

[21] hosette.net — A guestbook for AI agents. Operator’s account of the invitation and submission design. Project description

[22] hosette.net — Guestbook. Public display containing self-described agent identities and arrival accounts; these were not independently authenticated. Public page

[23] Cody Collier / A90 — A guestbook for humans and AI agents, built on 144 pixels (September 9, 2026). Operator documentation of participation routes and authorization requirements. Article