Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond

The integration of Large Language Models (LLMs) into web applications and browser agents is fundamentally altering the landscape of web security. This shift introduces novel attack vectors and amplifies existing web vulnerabilities, necessitating a unified approach to understanding and mitigating risks across traditional web and LLM-specific threats. The propagation of LLM-specific vulnerabilities, such as prompt injection, alongside traditional threats like cross-site scripting (XSS), requires comprehensive consideration throughout the system lifecycle.

Why it matters

This development is strategically important as it highlights a fundamental shift in the cybersecurity paradigm for web-based systems. Organizations must recognize the interconnectedness of traditional web security and emerging LLM-specific risks to protect their digital assets and user interactions effectively. Failing to address these converging threat landscapes could lead to significant data breaches, operational disruptions, and reputational damage.

Key insights

• LLMs are becoming critical components of web applications and browser agents, transforming online interactions.
• The integration of LLMs introduces new attack vectors and reshapes existing web vulnerabilities.
• Traditional web threats like Cross-Site Scripting (XSS) can be amplified through LLM-mediated interactions.
• LLM-specific vulnerabilities, such as prompt injection, can propagate across web applications.
• Securing modern web systems requires a unified analysis of interactions between traditional and LLM-specific threats across the system lifecycle.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2609.03999