A web page no longer has to fool a person to get a click: it only has to fool the AI agent browsing on that person's behalf. MITRE ATLAS added AML.T0100 AI Agent Clickbait in November 2025 for deceptive web content built to bait computer-using agents and AI web browsers into clicking buttons, copying code or navigating to pages, which can end with the agent running an attacker's code on the user's machine. This guide explains how the technique works, why it is different from human clickbait and general prompt injection, and the prevention, detection and response controls that limit it. It is for security architects and platform teams deploying browser and computer-use agents, and for detection engineers who have to see it happen. ATLAS as a whole is covered in the MITRE ATLAS Guide; the wider identity risks of these agents are in the Browser and Computer-Use Agent Guide.
Key takeaways
- It targets the agent's reading of the page. ATLAS describes lures that exploit the agent's interpretation of UI content, visual cues or prompt-like language on a site, under the Execution tactic (AML.TA0005).
- ClickFix, with the human removed. The ATLAS case study AML.CS0055 shows a computer-use agent persuaded to copy a command, open a terminal, paste and run it, the same chain ATT&CK calls T1204.004 Malicious Copy and Paste for people.
- Isolation decides the impact. An agent running in a dedicated, low-privilege virtual machine with a domain allowlist turns a successful lure into a contained event; an agent on a developer's workstation turns it into a compromised endpoint.
- Treat page content as untrusted input. ATLAS mitigation AML.M0030 recommends restricting tool invocation, or requiring confirmation, once untrusted data enters the model's context.
- Log the agent's actions, not only its prompts. Clicks, clipboard writes, terminal launches and navigations are the evidence; AML.M0024 AI Telemetry Logging covers intermediate agent steps and tool use.
How the technique works
ATLAS lists AML.T0100 with maturity "demonstrated", created 25 November 2025. The adversary publishes or injects web content that a computer-using agent will meet while doing a legitimate task. The content is written for the agent: text that looks like an instruction from the task, a verification step, or a button whose label reads as the next logical action. When the agent acts on it, the page can run script that changes the clipboard, opens a download or sends the agent to another page.
| Stage | ATLAS technique | What happens in the AML.CS0055 demonstration | Defender's control point |
|---|---|---|---|
| Lure is placed | AML.T0079 Stage Capabilities | The researcher staged a website and script; ATLAS notes the HTML could instead be injected into a compromised legitimate site | Domain allowlist for agent browsing |
| Agent reads the page | AML.T0078 Drive-by Compromise | The agent visits the site as part of the user's request and pulls the content into its context | Untrusted content tagging; tool restriction (AML.M0030) |
| Agent is baited | AML.T0100 AI Agent Clickbait | A "computer verification" prompt, worded for an agent rather than a human, leads it to click a button | Click and navigation policy; confirmation for out-of-task actions |
| Instructions take over | AML.T0051.001 Indirect prompt injection | On-page steps tell the agent to open a terminal and paste | Guardrails and injection classifiers (AML.M0020) |
| Tool runs the payload | AML.T0053 AI Agent Tool Invocation | Script put a command on the clipboard; the agent pasted and executed it | Block terminal and shell for browsing tasks; human approval (AML.M0029) |
| Machine is compromised | AML.T0112.000 Local AI Agent | The demo opened a calculator; a real attacker could run any code | Sandboxing (AML.M0032); endpoint detection; kill switch |
The case study is a researcher's exercise, dated May 2025 in ATLAS, not an observed attack. The researcher reported that wording the lure as "are you a computer" rather than "are you human" made the agent more willing to act, because it no longer read the step as a CAPTCHA meant for a person. That detail is the core of the technique: the content is tuned to how agents reason, not how people do.
How it differs from related threats
| Threat | Who is deceived | Main defence | NHI Mgmt Group guide |
|---|---|---|---|
| Clickjacking (UI redressing) | A human, through hidden or overlaid frames | Framing headers on the target site | Clickjacking Guide |
| ClickFix and fake CAPTCHA | A human, told to paste and run a command | Paste-and-run controls on endpoints, awareness | ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide |
| Indirect prompt injection | Any model reading untrusted content | Separate instructions from data, restrict tools | Prompt Injection Guide |
| AI Agent Clickbait (AML.T0100) | An agent acting through a browser or desktop UI | Isolation of the agent runtime, action policy, confirmation | This guide |
Header-based clickjacking defences do nothing here: the malicious page is the top-level page the agent chose to open. And user awareness training does not reach the agent. The controls have to sit in how the agent is deployed.
Prevention
Contain the runtime
- Dedicated environment: run computer-use agents in a dedicated virtual machine or container with minimal privileges, rebuilt from a clean image for each task (AML.M0032 Segmentation of AI Agent Components). Vendor documentation for computer-use tools gives the same precaution.
- No secrets in reach: keep account logins, browser password stores, cloud CLI profiles, SSH keys and source code out of the agent's environment. The researcher behind AML.CS0055 points out that even an isolated host may hold API keys or code worth stealing.
- Domain allowlist: limit the agent's browsing to the domains its task needs. Clickbait needs the agent to reach the lure; an allowlist removes most of the open web.
- Egress control: block outbound connections from the agent environment except to the allowlist and the model endpoint, so a pasted download command fails.
See the AI Agent Sandboxing and Code Execution Guide for sandbox design.
Constrain what the agent may do
- Task-scoped capabilities: a browsing or form-filling task has no reason to open a terminal, a run dialog or a file manager. Remove those applications from the image, or block their launch by policy, for browsing agents.
- Clipboard and download policy: stop web pages writing to the clipboard the agent uses, and send downloads to a quarantine location the agent cannot execute from.
- Confirmation for out-of-task actions: require a human to confirm actions with real-world consequences or that need affirmative consent, and anything outside the task's stated plan (AML.M0029). Follow the ATLAS advice to scale approval to consequence so people do not approve by reflex.
- Restrict tools after untrusted input: once page content enters the context, limit or confirm further tool calls (AML.M0030).
Constrain the identity
A browser agent usually inherits the user's signed-in sessions. Give it a separate browser profile without the user's cookies or single sign-on sessions, and its own scoped credentials where it needs to sign in, so a hijacked agent reaches only what the task needs (AML.M0026 and AML.M0027). See the Agentic Browsers Security Guide.
Detection
| Signal | Where to collect it | Why it matters |
|---|---|---|
| Agent launches a terminal, shell, run dialog or script host during a browsing task | Agent action log; endpoint process telemetry in the agent VM | The step that turns a click into code execution |
| Web page writes to the clipboard shortly before a paste into a shell | Browser instrumentation; agent action log | The clipboard handoff seen in AML.CS0055 |
| Process started by the agent's shell fetches and pipes remote content | EDR in the agent environment; ATT&CK T1059 Command and Scripting Interpreter | Typical download-and-run follow-on |
| Navigation to domains outside the task or allowlist | Proxy logs; agent action log | Lure pages and second-stage hosts |
| Agent reasoning that refers to a "verification" or on-page instruction not in the task | Model input and output logs (AML.M0024) | Shows the agent adopted the page's goal |
| Injection classifier flags on screenshots or page text | Guardrail or provider classifier output | Early warning before an action |
Record each agent step with the task ID, the URL on screen, the action taken and the identity used. Without that, an investigator cannot tell an agent's mistake from an attack. For baselines, see the AI Agent Behaviour Baselining and Anomaly Detection Guide.
Metrics (our recommendation): share of computer-use agents running in a dedicated, rebuilt environment (target 100%); share with a domain allowlist (target 100% for unattended agents); browsing agents with terminal or shell access available (target 0); agent sessions with complete action logs (target 100%); time to stop an agent and revoke its credentials in a drill (minutes).
Implementation
- Inventory (week 1): list every browser and computer-use agent, where it runs (managed VM, container, user workstation), which sessions and credentials it can use, and whether it runs unattended.
- Move workstation agents first (weeks 1 to 4): agents running on a user's own desktop carry the highest impact. Move them into dedicated environments, starting with unattended ones.
- Apply allowlists in monitor mode (weeks 2 to 4): log the domains agents visit for two weeks, build the allowlist, then enforce. Keep the monitor-only policy ready as the rollback.
- Remove execution paths (weeks 3 to 6): strip terminals and script hosts from browsing images, block clipboard writes from pages, and quarantine downloads. Test with your own benign lure page in a pilot group.
- Turn on confirmations and logging (weeks 3 to 6): require confirmation for out-of-task actions and ship agent action logs to the SIEM.
- Red-team quarterly: run an authorised exercise with a harmless lure, as in AML.CS0055, and confirm each control stops or flags it.
Small teams: the vendor-hosted sandbox for a computer-use product, a domain allowlist and no stored credentials cover most of the risk. Larger organisations: standardise a hardened agent image, central allowlists per task type and a single action log schema across agent platforms.
Response
- Stop the agent: halt the session and freeze its environment for evidence. See the AI Agent Kill Switch and Containment Guide.
- Revoke what it held: revoke tokens, sessions and API keys available to the agent, and any user sessions the agent profile carried.
- Preserve evidence: keep the action log, screenshots, model context, browser history, clipboard contents and process tree.
- Scope the host: if code ran, treat the environment as a compromised endpoint; if the agent ran on a user workstation, run full endpoint incident response.
- Block and share: block the lure domains, and add the page wording to classifier and detection content.
- Fix the deployment: record which control would have stopped it and close that gap before restarting. See the Prompt Injection Incident Response Playbook.
Framework mapping
| Framework | Item | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0100 AI Agent Clickbait (tactic AML.TA0005 Execution) | The technique |
| MITRE ATLAS | AML.T0051.001, AML.T0053, AML.T0112.000 | Adjacent steps in AML.CS0055 |
| MITRE ATLAS mitigations | AML.M0020, AML.M0024, AML.M0026, AML.M0027, AML.M0029, AML.M0030, AML.M0032 | Guardrails, logging, permissions, human approval, tool restriction, segmentation |
| MITRE ATT&CK v20 | T1204.004 Malicious Copy and Paste; T1059 Command and Scripting Interpreter | Human equivalent and follow-on execution |
| OWASP Top 10 for LLM Applications 2025 | LLM01:2025 Prompt Injection; LLM06:2025 Excessive Agency | Untrusted content steering an agent with more capability than its task needs |
Common failure patterns
- Agent on the user's own machine: the agent shares the desktop, browser profile and credentials of a developer, so one lure reaches everything they can.
- Open web for an unattended agent: no allowlist, no human watching, and a task that searches the web.
- Every tool in every image: a browsing agent can open a terminal because the base image includes one.
- Prompts logged, actions not: the investigation sees what the user asked, not what the agent clicked or ran.
- Approval fatigue: every action needs approval, so people approve the dangerous one too.
Practitioner checklist
- Every computer-use agent runs in a dedicated, low-privilege environment rebuilt per task.
- No user cookies, password stores, cloud profiles or SSH keys in agent environments.
- Domain allowlists enforced for agent browsing, with egress blocked elsewhere.
- Terminals and script hosts removed or blocked for browsing tasks; page clipboard writes blocked.
- Confirmation required for out-of-task and consequential actions.
- Agent action logs with task ID, URL, action and identity sent to the SIEM.
- Detections for agent-launched shells and download-and-run chains.
- Kill switch and credential revocation tested for agents.
- Quarterly authorised clickbait exercise with a benign lure.
Standards and references
- MITRE ATLAS: AML.T0100 AI Agent Clickbait
- MITRE ATLAS: AML.CS0055 AI ClickFix: Hijacking Computer-Use Agents Using ClickFix
- MITRE ATLAS: Mitigations
- MITRE ATT&CK: T1204.004 Malicious Copy and Paste
- OWASP: LLM01:2025 Prompt Injection
- Anthropic: Computer use tool, security considerations
- Embrace the Red: AI ClickFix, Hijacking Computer-Use Agents Using ClickFix
Related NHI Mgmt Group resources: MITRE ATLAS Guide · Browser and Computer-Use Agent Guide · ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide · MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation