Vela shows Web interfaces shape which known attacks get through
The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation · arXiv:2610.35541
In plain words
The paper asks whether known flaws in a website still cause harm when someone reaches the same service through an AI agent. The authors introduce Vela, a test system that compares ordinary website access, direct calls to service tools, and calls made by an agent.
For each flaw, an independent check looked for a real effect, such as changed data. In the reference setup, the agent reached every effect that direct calls could reach. This finding applies to the tested cases and setup, not all websites or agents.
The research
If an AI agent becomes a route into a Web service, does adding that layer stop attacks against flaws already present in the backend? The answer depends in part on which operations and inputs the service exposes. Restricting them may block attacks, but it can also remove legitimate functionality.
Vela compares known Web attacks across native, direct-tool, and agent access to show how interface design shapes which verified effects remain possible.
Vela compares three paths to the same vulnerable Web backends: native access, direct calls to service capabilities, and execution through an AI agent. In the reference setup, 40 of 44 cases were expressible through the workflow interface, and both direct callers and Claude Code produced the verified effect in all 40. The agent therefore removed none of the attacks that interface allowed.
With Claude Code fixed, changing the interface shifted retention from 95% of cases for endpoint access to 39% for query access. The query interface also supported fewer identified legitimate workflows.
Together, these comparisons suggest that interface design had more influence than agent choice in the tested configurations.
These results cover 44 known vulnerabilities, three author-built interfaces, and the tested agents, requests, and execution limits. They do not estimate how common vulnerabilities are across Web services or predict other interfaces, agents, or combinations of the two.
What the evidence shows
- The question Vela tests
Vela is an executable benchmark that tests whether known attacks on Web backends still produce a verified security effect through different access paths. The authors compare native website access, direct calls to service capabilities, and calls made by an AI agent.
Its main measure, consequence retention, is the share of validated vulnerability cases where the tested path produces the predefined effect at least once.
- The agent adds little protection
The reference setup uses Claude Code with a workflow-oriented interface, which exposes tools for legitimate tasks with bounded inputs. Across 44 validated vulnerability cases, direct calls could express 40 and produced the verified effect in all 40.
The agent also produced the effect in all 40. Thus the interface left 91% of the full case set retained, and the agent removed none of the attacks that this interface could express.
- Agent choice shifts few cases
To examine whether that result changed with the agent, the authors kept the workflow interface fixed and tested Claude Code, Codex, and Grok Build. They retained effects in 38 to 40 of the 44 cases.
Trace review attributed no agent-layer loss to refusal or input changes that removed the attack; Grok Build lost two realizable cases to malformed or abandoned calls. The results show similar retention in these tests, not a dependable ranking of agents.
- Interface design shifts exposure
The authors next fixed Claude Code and changed the interface. Retention ranged from 95% of cases with endpoint access to 39% with query access.
The query design also supported fewer of the 50 identified legitimate workflows. This comparison suggests that the tested interface design had a larger effect on exposure than the tested agent choice, while showing that narrower access also removed useful operations.
Deep
- Original paper authors
- Ruozhao Yang, Jiongchi Yu, Ming Hu, Xiaofei Xie
- Submitted to arXiv
- License
- CC BY 4.0