做 Web 智能体安全评估的团队会发现 StakeBench 补上了现有基准的盲区——它不只看攻击是否成功，还看谁承担了后果，建议安全研究人员和智能体开发者点开看看。
StakeBench 是一个新的安全基准，用于评估 LLM 驱动的 Web 智能体在面对提示注入攻击时的风险。与现有仅关注攻击可行性的基准不同，StakeBench 采用利益相关者中心视角，区分攻击对用户、卖家、平台等不同实体的影响。研究发现，当前智能体无法可靠抵御任何攻击目标，且失败模式多样，包括“隐蔽寄生”（攻击成功但不干扰用户任务）、“错位破坏”（任务中断但攻击失败）和“复合失败”（攻击和任务均失败）。该基准揭示了传统评估忽略的漏洞分布，强调了在真实部署中需要利益相关者感知的评估。代码已开源。
Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents
Web agents driven by large language models (LLMs) are increasingly deployed in real-world environments, where they operate over untrusted web content and execute actions with direct consequences. This makes them vulnerable to prompt-injection attacks, in which seemingly benign content embeds adversarial instructions that manipulate agent behaviour. Existing security benchmarks adopt an \textit{attack-centric} perspective, focusing on the technical feasibility of injections while overlooking the nuanced distribution of resulting harms. In practice, however, prompt-injection risk is victim-dependent: a single exploit can produce asymmetric consequences for different stakeholders, and the same attack pattern may exhibit substantially different effectiveness depending on whom it targets. To capture these properties, we introduce \textbf{\sysname}, a \textit{stakeholder-centric} benchmark to systematically categorize and attribute harm in real-world web agent systems. It distinguishes between affected entities (e.g., user, seller, platform), decomposes the attacks into concrete objectives, and evaluates each case with complementary outcome- and process-level metrics. Our results reveal substantial and heterogeneous vulnerabilities: not a single attack objective is reliably resisted by current agents, and failures distribute across qualitatively distinct modes ranging from \emph{stealthy parasitism} (attack succeeds without disrupting the user's delegated task) to \emph{misaligned disruption} (task disrupted without attack success) and \emph{compounded failure} (both adversarial objective and task integrity simultaneously violated). These patterns are missed by conventional evaluation, highlighting the need for stakeholder-aware assessment of LLM-based agents in real-world deployments. Benchmark is available at https://github.com/StakeBench/SBC.