What happened
An arXiv study introduces Vela, an executable benchmark of 44 documented web vulnerabilities across twelve application families, and compares direct web access, direct agent-facing-interface invocation, and execution through three commercial LLM agents against the same vulnerable backends. The results show the agent realizes every attack that direct interface invocation realizes in the reference configuration, with 91% of vulnerabilities remaining exploitable under the reference design, and no case-level loss attributed to agent refusal or input normalization. In one case the agent completed an attack by supplying calls the attacker omitted. Across tested configurations, interface design affected exploitability far more than agent choice (retention moving from 39% to 95%), and restrictive interfaces also disabled legitimate workflows.
Why it matters
As services (e.g. commerce protocols) expose agent-facing interfaces, the security question shifts to whether existing backend vulnerabilities remain exploitable through an agent. This study provides empirical evidence that agent-mediated access does not inherently reduce exploitability — 91% of vulnerabilities persist in the reference design — so operators of agentic access layers should treat interface design and input/operation restrictions as the primary control, and confirm that agent safeguards are not merely shifting the attack surface. It grounds real defender decisions about how to architect agent-facing services.
Attack vector
A malicious user drives existing web-app backend vulnerabilities through an agent-facing interface: the agent follows the malicious goal, supplies missing steps and combines calls, and interface restrictions (not agent safety) are the dominant factor in whether the exploit completes.
Affected systems
Agent-mediated web-access architectures and agent-facing interfaces generally (benchmark of 44 web vulnerabilities across 12 web-app families and three commercial agents)
Mitigation
For agent-facing interfaces, restrict required operations and inputs rather than relying on agent safety training, and validate the attack surface with interface-level benchmarks; monitor exploitability retention (39%–95%) when designing restrictive interfaces and reject designs that disable legitimate workflows without reducing exposure.