Working notes behind llm_agents — every query with its population, the fold rule and its residue, the quotes that were checked, the external sources that were verified and the ones that were rejected, and the judgement calls. Corpus-level caveats are on corpus and are not repeated here.

Written 2026-08-29, against data/extract/run1 as of that date: 5,859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026.

This page also closes a work item left open by crawler §5.3 on 2026-08-12 — whether the LLM-agent strings in that page's residue should become a fold family. They did. See §4.

Two pages were edited as a consequence, both because the shared fold changed: crawler (five figures and a new table row, §4.3) and crawler (the same figures, plus §5.3 resolved and one 2026-08-12 statement corrected).

Every query, in the form the content page cannot carry.

Q9's pattern, kept out of the table because a DokuWiki table cell cannot contain a pipe and \| is not an escape:

/agent|mcp|llm|gpt|autonomous/i

Q2a against Q2b is a real boundary, not a rounding detail, and the page publishes the larger number. The one paper between them is [1Song, Chuxu; Mekala, Dheekshith Dev Manohar; Wang, Hao; Martin, Richard (2026): "Redefining Website Fingerprinting Attacks with Multi-Agent LLMs", in: Proceedings on Privacy Enhancing Technologies, pp. 688-702. (DOI)], whose Claude Computer Use API tuple the extraction filed under category llm. By any reading of the paper that agent drove the data collection — it is marked instrument in the hand-assigned role table — so a page about crawling with agents has to count it. The framework table on crawler cannot: every row there is Q2a, because that is what makes Selenium, Playwright and this family comparable with each other. So the two pages carry 5 and 4, and both say why. The draft published 4 on both pages until a review pass found the fifth; the report script now prints Q2a, Q2b and the paper between them, so the boundary cannot close over silently again.

crawled is defined exactly as data/extract/OVERVIEW.md defines it — a paper whose crawl configuration was recorded or whose studyTypes include automated-web-crawl — and is 1,120 papers, 19.1% of the corpus.

Denominators that are not used anywhere on the content page, and why: “of 5,859 papers” for anything about crawling instruments (only 1,120 crawled); “of the 9 papers” for anything about crawling practice (six of the nine do not crawl in the ordinary sense); and “of the 2026 papers” for a rate (2026 is incomplete by construction).

node scripts/report_llm_agents.mjs > scripts/report_llm_agents-output.txt

Unedited:

corpus: 5859 papers, 7 venues, 2010-2026
population 'crawled': 1120 papers (19.1%)


=== Papers naming an LLM browser-agent framework in tools[] ===

9 papers of 5859 in the corpus (0.2%).

Year  Papers naming one
----  -----------------
2025  1
2026  8

Every paper found has a hand-assigned role in ROLES[].


=== Of the crawling papers, how many drove the crawl with an agent ===

Q2a, automation categories only: 4 of 1120 crawling papers (0.4%).
       This is the query report_crawler.mjs runs, and the row the family adds
       to the framework table on Programming:Crawler.
Paper                                                                                        Framework(s)          Category
-------------------------------------------------------------------------------------------  --------------------  -------------------------------------
USENIX/2026/network-level-prompt-and-trait-leakage-in-local-research-agents                  Browser-Use           browser-automation
WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of     AgentLab, BrowserGym  crawler-framework, browser-automation
USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web  Browser Use           browser-automation
PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits                    browser-use           crawler-framework

Q2b, any category: 5 of 1120 crawling papers (0.4%).
       This is what the page publishes.
Paper                                                                                        Framework(s)             Category
-------------------------------------------------------------------------------------------  -----------------------  -------------------------------------
PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms                    Claude Computer Use API  llm
USENIX/2026/network-level-prompt-and-trait-leakage-in-local-research-agents                  Browser-Use              browser-automation
WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of     AgentLab, BrowserGym     crawler-framework, browser-automation
USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web  Browser Use              browser-automation
PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits                    browser-use              crawler-framework

Difference, Q2b minus Q2a: 1 paper(s) — PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms

Years represented: 2026 — the whole family is inside the provisional slice.


=== Instrument or subject, per paper ===

Role        Papers
----------  ------
instrument  3
both        3
subject     2
baseline    1

INSTRUMENT  PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits  {[sun2026_suitability]}
            "We implement our auditing agent using the browser-use framework (v0.9.5) [6], deployed on a California-hosted server."
INSTRUMENT  USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web  {[jannett2026_passkeys]}
            "We built a prototype tool using Playwright [34] and the agentic LLMbased Browser Use framework [14]."
INSTRUMENT  PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms  {[song2026_wfpllm]}
            "The Computer-Using Agent (CUA) executes these commands inside a real browser using Claude's Computer Use API"
BOTH        USENIX/2026/network-level-prompt-and-trait-leakage-in-local-research-agents  {[jeong2026_network]}
            "Browser-Use [46]. An open-source web agent that automates browsing through a local browser. To ensure stable traces, we configure it to start from Bing"
BOTH        WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of  {[steiner2026_nlweb]}
            "The agent uses the AgentLab library and is exe[...]cuted within the BrowserGym framework [1]."
BOTH        PETS/2026/websp-eval-evaluating-web-agents-on-website-security-and-privacy-tasks  {[ramesh2026_webspeval]}
            "We develop a system to execute instances from our dataset by building upon the base implementation logic and action space of WebVoyager"
SUBJECT     IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents  {[ersoy2026_investigating]}
            "we evaluate four commercial agents (Skyvern [7], DoBrowser [18], BrowserUse [19], and Agent-E [20]) and two academic web agents (WebArena [8] and VisualWebArena [9])"
SUBJECT     USENIX/2026/overcoming-the-retrieval-barrier-indirect-prompt-injection-in-the-wild-for-llm-s  {[chang2026_overcoming]}
            "For the multi-agent setting, we use Magentic-One [31] in AutoGen"
BASELINE    USENIX/2025/are-captchas-still-bot-hard-generalized-visual-captcha-solving-with-agentic-visi  {[teoh2025_captcha]}
            "WebVoyager and ShowWUI achieve solve rates of 8.9% (232/2600) and 9.8% (254/2600), respectively."


=== Which agent frameworks are named, and by how many papers ===

Raw strings, before folding — the fold merges these into one family, but the
page names individual tools, so the individual counts are what it can quote.

Tool string              Papers
-----------------------  ------
WebVoyager               2
Agent-E                  1
AgentLab                 1
Browser Use              1
browser-use              1
Browser-Use              1
BrowserGym               1
BrowserUse               1
Claude Computer Use API  1
DoBrowser                1
Magentic-One             1
Skyvern                  1
VisualWebArena           1
WebArena                 1


=== Does the paper state the agent framework version ===

1 of 15 agent-tool mentions state a version.
   PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits  browser-use 0.9.5

A model version is a second version this field does not carry: the LLM behind
the agent. Those are in tools[] with category "llm" and are listed next.


=== Which LLM the agent papers ran ===

USENIX/2025/are-captchas-still-bot-hard-generalized-visual-captcha-solving-with-agentic-visi
   Halligan, GPT-4o
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   GPT-4o, Claude 3.7 Sonnet, Gemini 2.5 Pro
PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms
   Claude 3.7 Sonnet, Claude Computer Use API
USENIX/2026/network-level-prompt-and-trait-leakage-in-local-research-agents
   GPT-4o, GPT-4.1, Gemini 2.0 Flash, Gemini 2.5 Pro, GPT-4
PETS/2026/websp-eval-evaluating-web-agents-on-website-security-and-privacy-tasks
   Gemini-3.1-Pro, Claude-Opus-4.6, GPT-5.2, Gemini-3-Pro, Gemini-2.5-Pro, Gemini-2.5-Flash, Claude-Sonnet-4.5, Gemma-3-27B
WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of
   GPT-4.1, GPT-5, GPT-5-mini, Claude Sonnet 4
USENIX/2026/overcoming-the-retrieval-barrier-indirect-prompt-injection-in-the-wild-for-llm-s
   Claude Sonnet 4, GPT-4o, GPT-4o-mini
USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
   (no tools[] entry with category llm)
PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits
   GPT-5


=== Scale: the same population, other instruments ===

Every row uses the automation-category query (Q2a), because that is the only
way the families are comparable with each other and with Programming:Crawler.
Family                             Papers  Share of 1120
---------------------------------  ------  -------------
Selenium                           242     21.6%
Puppeteer                          76      6.8%
Playwright                         34      3.0%
OpenWPM                            58      5.2%
Chrome DevTools Protocol (direct)  42      3.8%
LLM browser agents                 4       0.4%


=== For contrast: LLMs as a classifier, not as a driver ===

classification.method == "llm" fires on 177 papers of 5859 (3.0%).

Year  Papers classifying with an LLM
----  ------------------------------
2023  2
2024  27
2025  77
2026  71

Same corpus, same years. The gap between this and the agent counts above is
the page's dating argument: LLMs arrived in this literature as classifiers
years before they arrived as browser drivers, and are still far more common there.


=== Fold: what was deliberately left out of the family ===

Strings in an automation category whose name looks agent-ish but that the
family does NOT claim. Each is a decision, not an oversight:

Paper                                                                                          String                                Category            Folds to
---------------------------------------------------------------------------------------------  ------------------------------------  ------------------  ---------
IEEE-SP/2025/gptracker-a-large-scale-measurement-of-misused-gpts                               GPT RACKER                            crawler-framework   (residue)
IEEE-SP/2025/on-the-in-security-of-llm-app-stores                                              Free GPTs Scraper                     crawler-framework   (residue)
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents                 LiteAgent                             crawler-framework   (residue)
IEEE-SP/2026/parasites-in-the-toolchain-a-large-scale-analysis-of-attacks-on-the-mcp-ecosyste  MCP Server Crawler                    crawler-framework   (residue)
PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc     Super Agent-Automatic Cookie Consent  browser-automation  (residue)

# Regenerate the crawler report FIRST. The committed out/new/report_crawler.txt
# predates this run's fold change, and with the stale file the guard flags seven
# figures on programming:crawler (181, 16.2%, 199, 205, 318, 28.4%, 74) that are
# in fact correct. A review pass hit exactly that.
node scripts/report_crawler.mjs > out/new/report_crawler.txt
node scripts/report_llm_agents.mjs      > scripts/report_llm_agents-output.txt
node scripts/verify_llm_agents_figures.mjs > scripts/verify_llm_agents_figures-output.txt
node scripts/llm_agents_quotecheck.mjs  > scripts/llm_agents_quotecheck-output.txt
node scripts/llm_agent_fulltext_probe.mjs --dropped > scripts/llm_agent_fulltext_probe-output.txt
./scripts/external_checks_llm_agents.sh > scripts/external_checks_llm_agents-output.txt

cat scripts/report_llm_agents-output.txt scripts/verify_llm_agents_figures-output.txt \
    scripts/external_checks_llm_agents-output.txt scripts/llm_agents_quotecheck-output.txt \
    scripts/llm_agent_fulltext_probe-output.txt out/new/report_crawler.txt \
  > /tmp/llm_agents_backing.txt
node scripts/check_page_numbers.mjs pages/programming_crawler_llm_agents.txt /tmp/llm_agents_backing.txt
node scripts/check_page_numbers.mjs pages/programming_crawler.txt out/new/report_crawler.txt

Whole-page, not windowed. Two figures are unaccounted and both are deliberate:

5.1 — a section number, §5.1 of [2Sun, Chen; Vekaria, Yash; Nithyanand, Rishab (2026): "On the Suitability of LLM-Driven Agents for Dark Pattern Audits", Proceedings on Privacy Enhancing Technologies 2026(4):927-946. (DOI)], inside a footnote about that paper's phase labelling — was unaccounted for until a later verifier check pulled the WebSP-Eval results table into the backing file, where the model name GPT-5.1 now satisfies it. That is not a check passing; it is the guard doing what it does, which is to trace digits and not meaning. Recorded rather than hidden, because the same mechanism is how a genuinely stale figure could be blessed by an unrelated number appearing somewhere in a report.

It also lists five version identifiers as absent — 0.0.79, 0.2.0, 0.2.9.0, 0.4.2, 1.0.51. All five are in external_checks_llm_agents-output.txt, with the v prefix GitHub returns (v0.0.79 and so on) and the guard strips. This is a formatting mismatch in the guard, not a stale figure; every one of the five is checked in §8.

None of these were added to the shared ALLOW map in check_page_numbers.mjs, because that map is global to every page and two page-specific exceptions do not belong in it. They are recorded here instead.

A formatting change the guard forced, and it is worth recording because it is the right outcome: the page originally wrote “241,000 tokens” and “287,000 tokens” where the papers write “241k” and “287k”. The guard could not match them, and rather than silence it the page was changed to quote the papers' own notation.

A new family in scripts/tool_fold.mjs, ordered before Playwright and Puppeteer, because several of these agents sit on those libraries (Skyvern requires playwright>=1.46.0, BrowserGym pins playwright==1.44) and a compound name matched in the wrong order folds into the library, erasing exactly the distinction the family exists to record. Browser Use itself is the exception and it is worth stating: it depends on cdp-use and speaks CDP directly (§8.1b).

F(
  'LLM browser agents',
  /^browser[-_ ]?use$|^browseruse$|browser[-_]use framework|^browsergym$|^agentlab$|^agent-e$|^skyvern$|^dobrowser$|^stagehand$|^webvoyager$|^visualwebarena$|^webarena$|^mind2web$|^multion$|^magentic-?one$|^nanobrowser$|claude('s)? computer.use( api)?$|^computer.using agent( \(cua\))?$|^openai operator$/i
),

It is an explicit name list, not a pattern over the word “agent”. A pattern would claim LiteAgent (a harness for measuring agents), Super Agent-Automatic Cookie Consent (a consent extension) and WebAgentDriver (an Appium iOS driver), none of which is an LLM browser agent.

Unit test of the rule, run before anything else:

"browser-use"             -> LLM browser agents
"Browser Use"             -> LLM browser agents
"BrowserUse"              -> LLM browser agents
"BrowserGym"              -> LLM browser agents
"AgentLab"                -> LLM browser agents
"WebVoyager"              -> LLM browser agents
"Skyvern"                 -> LLM browser agents
"Agent-E"                 -> LLM browser agents
"Claude Computer Use API" -> LLM browser agents
"MCP Server Crawler"      -> null            <- deliberate, see 4.2
"WebAgentDriver"          -> null            <- deliberate, see 4.2
"Playwright"              -> Playwright      <- ordering holds
"puppeteer-extra-plugin-stealth" -> Anti-detection patches
"Selenium"                -> Selenium

The family's residue within the automation categories is five strings, printed by the report (§3, last section) and reproduced here because it is short enough to read:

Two further exclusions do not appear in that table because they sit in other categories, and both are written into the fold file as comments so the next run does not re-add them:

• WebAgentDriver (NDSS/2026 ChameleoScan, category mobile-instrumentation) is the Appium XCUITest driver on jailbroken iOS.
• Crawl4AI and Firecrawl are conventional crawlers that emit Markdown for a model to read afterwards. Nothing in them chooses the next action at run time. No paper in the corpus names either in tools[], so excluding them changes no count — the rule exists only so the next person does not add them on the strength of the name. (Both are cited in three papers' related work; the full-text probe in §5 finds them and the extraction does not, which is the expected relationship between the two.)

The fold file is shared, so report_crawler.mjs changed the moment the family was added. The diff of its output, before against after, in full:

19c19
< (residue) Bespoke crawler, given its own name   184     16.4%
---
> (residue) Bespoke crawler, given its own name   181     16.2%
39a40
> LLM browser agents                              4       0.4%
42c43
< residue papers: 184; of those, 75 named nothing else, i.e. the one-off name is the only instrument the paper identifies.
---
> residue papers: 181; of those, 74 named nothing else, i.e. the one-off name is the only instrument the paper identifies.
138c139
< 204 distinct strings, 210 paper-mentions unmapped.
---
> 199 distinct strings, 205 paper-mentions unmapped.
294d294
<    1  "Browser-Use"
299,300d298
<    1  "AgentLab"
<    1  "BrowserGym"
326,327d323
<    1  "Browser Use"
<    1  "browser-use"
360c356
< Bespoke: 147 generic + 184 own-name, 10 in both, union 321 of 1120 (28.7%).
---
> Bespoke: 147 generic + 181 own-name, 10 in both, union 318 of 1120 (28.4%).

Five published figures on crawler moved as a result, and all five were patched in the same sitting rather than left for a later refresh:

A new row was added to that page's framework table, in the position the report prints it (between Fuzzers and monkey testers at 5 and webXray at 1), and a short Agent-Driven Crawling section was added above Being Detected pointing at the child page. Nothing else on that page was touched. Verified afterwards with check_page_numbers.mjs windowed and whole-page: the only unaccounted figures are the four that page's own provenance already documents as permanent (100, 106, 19.1, 53) plus its sandbox and vendor figures.

The extraction only sees a framework when it lands in tools[]. An independent probe over all 5,869 rendered paper.cols.txt files — ten more than the 5,859 papers in the extraction run, because text was rendered for a few papers the extraction did not keep — answers the different question of where these names appear at all — and is the reason the counts in §3 are not larger: every occurrence outside the nine papers is related work.

Every probe has a wide form (what a first attempt would write) and a tight form, and the script prints how many paper/probe pairs the tightening discarded and a sample of each. This is not defensive engineering; it is the whole finding:

• The decolumniser joins hyphenated line breaks, so browser-\nbased becomes browserbased. A plain /browserbase/i probe reports 45 papers going back to 2010, and the tight form reports 0. Not one of the 45 is about Browserbase.
• /computer[-\s]use/i reports 75 papers; "Date of first computer use" in a 2011 demographics table is not Claude Computer Use. Tight: 3.
• /browser[-\s]?use\b/i matches "Browser Use History" (a 2021 demographics row) and "SafeBrowserUser" (a 2026 regression variable). Tight: 6, dropping 14.
• /web[-\s]?arena/i matches "beyond the web arena" in a 2016 notification paper. Case-sensitive WebArena: 7.
• /\bmulti-?on\b/i matches "collaboration of multion. tiple participants" — a column-interleaved line break. Tight MultiOn: 2.
• /\bautogen\b/i matches the autotools autogen script in a 2017 paper. Tight AutoGen: 8.

140 paper/probe pairs were discarded by tightening; 48 papers survive across 16 probes. Had the wide forms been published, this page would have reported an LLM-agent literature stretching back to 2010.

The invocation matters: without –dropped the script prints the summary and the surviving papers but not the residue, which is the half worth reading.

node scripts/llm_agent_fulltext_probe.mjs --dropped

Its summary and the complete discarded residue:

Scanned 5869 paper.cols.txt files under /workspace/publications_dataset/data/fulltext
Papers matching at least one TIGHT probe: 48
Paper/probe pairs the tightening discarded: 140

Probe              Papers  Dropped  Years (tight)
langchain              25        1  2024:2 2025:6 2026:17
mcp                    14        0  2026:14
mind2web               12        0  2024:2 2025:2 2026:8
autogen                 8        3  2025:1 2026:7
webarena                7        1  2026:7
browser-use             6       14  2026:6
webvoyager              4        0  2025:1 2026:3
computer-use            3       72  2026:3
firecrawl               3        0  2025:1 2026:2
skyvern                 3        0  2025:1 2026:2
agentlab                2        0  2026:2
browsergym              2        0  2026:2
multion                 2        4  2026:2
agent-e                 1        0  2026:1
magentic-one            1        0  2026:1
openai-operator         1        0  2026:1
browserbase             0       45  

--- papers, with every tight probe that fired ---
CCS/2025/a-decade-long-landscape-of-advanced-persistent-threats-longitudinal-analysis-and	langchain(7)
IEEE-SP/2024/where-urls-become-weapons-automated-discovery-of-ssrf-vulnerabilities-in-web-app	langchain(1)
IEEE-SP/2025/understanding-users-security-and-privacy-concerns-and-attitudes-towards-conversa	langchain(2)
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents	browser-use(49) webarena(41) mind2web(1) skyvern(46) agent-e(30) computer-use(1) mcp(4) firecrawl(2)
IEEE-SP/2026/parasites-in-the-toolchain-a-large-scale-analysis-of-attacks-on-the-mcp-ecosyste	mcp(377) firecrawl(2)
IEEE-SP/2026/towards-automating-data-access-permissions-in-ai-agents	computer-use(1) langchain(3)
NDSS/2025/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search	mind2web(2)
NDSS/2025/isolategpt-an-execution-isolation-architecture-for-llm-based-agentic-systems	langchain(42)
NDSS/2025/the-philosophers-stone-trojaning-plugins-of-large-language-models	langchain(6)
NDSS/2025/yurascanner-leveraging-llms-for-task-driven-web-app-scanning	mind2web(2) skyvern(6)
NDSS/2026/anota-identifying-business-logic-vulnerabilities-via-annotation-based-sanitization	langchain(3)
NDSS/2026/beyond-jailbreak-unveiling-risks-in-llm-applications-arising-from-blurred-capability-boundaries	autogen(1) langchain(5)
NDSS/2026/cache-me-catch-you-cache-related-security-threats-in-llm-serving-frameworks	langchain(13)
NDSS/2026/chimera-harnessing-multi-agent-llms-for-automatic-insider-threat-simulation	mcp(1) autogen(2)
NDSS/2026/indicator-of-benignity-an-industry-view-of-false-positive-in-malicious-domain-detection-and-its-mitigation	mind2web(2)
NDSS/2026/les-dissonances-cross-tool-harvesting-and-polluting-in-pool-of-tools-empowered-llm-agents	multion(1) mcp(5) langchain(117)
NDSS/2026/obliinjection-order-oblivious-prompt-injection-attack-to-llm-agents-with-multi-source-data	mcp(1)
NDSS/2026/prompt-injection-attack-to-tool-selection-in-llm-agents	mind2web(1) mcp(1) langchain(1)
NDSS/2026/when-cache-poisoning-meets-llm-systems-semantic-cache-poisoning-and-its-countermeasures	langchain(2)
PETS/2026/ai-in-the-loop-privacy-preserving-real-time-scam-detection-and-conversational-sc	autogen(1)
PETS/2026/audagent-automated-auditing-of-privacy-policy-compliance-in-ai-agents	mcp(9) autogen(11) langchain(10)
PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits	browser-use(8) webarena(1) webvoyager(1) mind2web(2) skyvern(2) multion(1)
PETS/2026/personal-data-flows-and-privacy-policy-traceability-in-third-party-llm-apps-in-t	mcp(4)
PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms	webarena(1) computer-use(3) autogen(1)
PETS/2026/websp-eval-evaluating-web-agents-on-website-security-and-privacy-tasks	browser-use(1) browsergym(2) agentlab(1) webarena(9) webvoyager(24) mind2web(2)
USENIX/2024/less-defined-knowledge-and-more-true-alarms-reference-based-phishing-detection-w	mind2web(2)
USENIX/2024/phishdecloaker-detecting-captcha-cloaked-phishing-websites-via-hybrid-vision-bas	mind2web(1)
USENIX/2025/are-captchas-still-bot-hard-generalized-visual-captcha-solving-with-agentic-visi	webvoyager(6)
USENIX/2025/evaluating-privacy-policies-under-modern-privacy-laws-at-scale-an-llm-based-auto	firecrawl(3)
USENIX/2025/make-agent-defeat-agent-automatic-detection-of-taint-style-vulnerabilities-in-ll	langchain(3)
USENIX/2025/unsafe-llm-based-search-quantitative-analysis-and-mitigation-of-safety-risks-in	langchain(1)
USENIX/2026/a-large-scale-study-of-personalized-phishing-using-large-language-models	langchain(2)
USENIX/2026/abuse-risks-are-often-inherent-to-product-features-exploring-ai-vendors-bug-boun	langchain(1)
USENIX/2026/bridges-to-self-silent-web-to-app-tracking-on-mobile-via-localhost	mcp(2)
USENIX/2026/masleak-investigating-and-exposing-intellectual-property-leakage-vulnerabilities	langchain(2)
USENIX/2026/network-level-prompt-and-trait-leakage-in-local-research-agents	browser-use(2) openai-operator(1) autogen(12) langchain(4)
USENIX/2026/overcoming-the-retrieval-barrier-indirect-prompt-injection-in-the-wild-for-llm-s	mcp(3) magentic-one(2) autogen(3)
USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web	browser-use(5)
USENIX/2026/when-memory-becomes-a-vulnerability-towards-multi-turn-jailbreak-attacks-against	langchain(10)
WWW/2024/experimental-security-analysis-of-sensitive-data-access-by-browser-extensions	langchain(5)
WWW/2025/thematic-lm-a-llm-based-multi-agent-system-for-large-scale-thematic-analysis	autogen(1)
WWW/2026/egocentric-co-pilot-web-native-smart-glasses-agents-for-assistive-egocentric-ai	webarena(1) webvoyager(1) mind2web(1) mcp(15) langchain(2)
WWW/2026/falconscope-effective-and-efficient-detection-of-hidden-web-interfaces-in-iot-de	langchain(5)
WWW/2026/hidden-in-plain-text-a-benchmark-for-social-web-indirect-prompt-injection-in-rag	webarena(1)
WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of	browsergym(2) agentlab(1) webarena(3) mind2web(2) mcp(87)
WWW/2026/paperask-a-benchmark-for-reliability-evaluation-of-llms-in-paper-search-and-read	mcp(1)
WWW/2026/sage-rai-design-patterns-for-transparent-rag-systems	mcp(4) langchain(1)
WWW/2026/what-is-your-ai-agent-buying-evaluation-biases-model-dependence-emerging-implica	browser-use(2) mind2web(1) langchain(1)

--- discarded by tightening (this is the residue) ---

## computer-use — 72 papers dropped
   IEEE-SP/2011/i-still-know-what-you-visited-last-summer-leaking-browsing-history-via-user-inte
     …d to: ETH BIBLIOTHEK ZURICH. Downloaded on August 10,2026 at 10:17:05 UTC from IEEE Xplore. Restrictions apply. Age Date of first computer use Daily Internet use (hours) Number of computers owned Web design skill 50% 33% 16% 0% Before 1984− 1994− 2000− 2005− 18−29 30−49 50−69 70+ <1 1 2−4 4−8 8+ 0 1…
   IEEE-SP/2011/using-fingerprint-authentication-to-reduce-system-security-an-empirical-study
     …ad some effects, particularly in environments that require more security, it has failed to replace passwords-the vast majority of computer users still use passwords on a day-to-day basis. Since the security of passwords relies so heavily on user behavior, studies that empirically examine patterns of…
   CCS/2012/towards-measuring-warning-readability
     …t has been recognised that the descriptive text provided in warning messages needs to be comprehensive and understandable by most computer users. In 2011, Bravo-Lillo et al. [3] compiled a set of design guidelines and present rules for descriptive text, including: • "describe the risk; describe cons…
   … and 69 more: USENIX/2012/on-the-feasibility-of-side-channel-attacks-with-brain-computer-interfaces, CCS/2013/a-clinical-study-of-risk-factors-related-to-malware-infections, CCS/2014/an-epidemiological-study-of-malware-encounters-in-a-large-enterprise, CCS/2014/context-free-attacks-using-keyboard-acoustic-emanations, CCS/2014/security-analyses-of-click-based-graphical-passwords-via-image-point-memorabilit, CCS/2014/security-analysis-of-the-estonian-internet-voting-system, IEEE-SP/2014/zebra-zero-effort-bilateral-recurring-authentication, USENIX/2014/a-large-scale-empirical-analysis-of-chinese-web-passwords, USENIX/2014/iseeyou-disabling-the-macbook-webcam-indicator-led, CCS/2015/a-multi-modal-neuro-physiological-study-of-phishing-detection-and-malware-warnin, CCS/2015/imperfect-forward-secrecy-how-diffie-hellman-fails-in-practice, CCS/2015/surpass-system-initiated-user-replaceable-passwords, IMC/2015/affiliate-crookies-characterizing-affiliate-marketing-abuse, CCS/2016/how-i-learned-to-be-secure-a-census-representative-survey-of-security-advice-sou, IEEE-SP/2016/i-think-theyre-trying-to-tell-me-something-advice-sources-and-selection-for-digi, CCS/2017/lets-go-in-for-a-closer-look-observing-passwords-in-their-natural-habitat, NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams, PETS/2017/social-engineering-attacks-on-government-opponents-target-perspectives, WWW/2017/neural-underpinnings-of-website-legitimacy-and-familiarity-detection-an-fnirs-st, CCS/2018/towards-usable-checksums-automating-the-integrity-verification-of-web-downloads, IEEE-SP/2018/computer-security-and-privacy-for-refugees-in-the-united-states, PETS/2018/turtles-locks-and-bathrooms-understanding-mental-models-of-privacy-through-illus, PETS/2018/undermining-privacy-in-the-aircraft-communications-addressing-and-reporting-syst, USENIX/2018/automatic-heap-layout-manipulation-for-exploitation, USENIX/2018/sad-thug-structural-anomaly-detection-for-transmissions-of-high-value-informatio, CCS/2019/seeing-isnt-believing-towards-more-robust-adversarial-attack-against-real-world, IEEE-SP/2019/hard-drive-of-hearing-disks-that-eavesdrop-with-a-synthesized-microphone, USENIX/2019/computer-security-and-privacy-in-the-interactions-between-victim-service-provide, IMC/2020/who-is-targeted-by-email-based-phishing-and-malware-measuring-factors-that-diffe, USENIX/2020/the-impact-of-ad-blockers-on-product-search-and-purchase-behavior-a-lab-experime, IEEE-SP/2021/defensive-technology-use-by-political-activists-during-the-sudanese-revolution, IEEE-SP/2021/survivalism-systematic-analysis-of-windows-malware-living-off-the-land, PETS/2021/awareness-adoption-and-misconceptions-of-web-privacy-tools, PETS/2021/residue-free-computing, PETS/2021/warn-them-or-just-block-them-investigating-privacy-concerns-among-older-and-work, USENIX/2021/hiding-the-access-pattern-is-not-enough-exploiting-search-pattern-leakage-in-sea, USENIX/2021/inexpensive-brainwave-authentication-new-techniques-and-insights-on-user-accepta, USENIX/2021/passwords-keep-me-safe-understanding-what-children-think-about-passwords, WWW/2021/from-personal-data-to-digital-legacy-exploring-conflicts-in-the-sharing-security, IEEE-SP/2022/phishing-in-organizations-findings-from-a-large-scale-and-long-term-study, PETS/2022/it-feels-like-whack-a-mole-user-experiences-of-data-removal-from-people-search-w, IEEE-SP/2023/in-eighty-percent-of-the-cases-i-select-the-password-for-them-security-and-priva, NDSS/2023/auto-draft-336, PETS/2023/on-the-role-and-form-of-personal-information-disclosure-in-cyberbullying-inciden, PETS/2023/structural-and-functional-explanations-for-informing-lay-and-expert-users-the-ca, USENIX/2023/a-bugs-life-analyzing-the-lifecycle-and-mitigation-process-of-content-security-p, USENIX/2023/a-research-framework-and-initial-study-of-browser-security-for-the-visually-impa, USENIX/2023/content-type-multipart-oracle-tapping-into-format-oracles-in-email-end-to-end-en, USENIX/2023/how-library-it-staff-navigate-privacy-and-security-challenges-and-responsibiliti, USENIX/2023/my-privacy-for-their-security-employees-privacy-perspectives-and-expectations-wh, USENIX/2023/un-equal-online-safety-a-gender-analysis-of-security-and-privacy-protection-advi, USENIX/2023/work-from-home-and-covid-19-trajectories-of-endpoint-security-management-in-a-se, CCS/2024/blind-and-low-vision-individuals-detection-of-audio-deepfakes, IEEE-SP/2024/understanding-parents-perceptions-and-practices-toward-childrens-security-and-pr, PETS/2024/tailoring-digital-privacy-education-interventions-for-older-adults-a-comparative, USENIX/2024/i-really-just-leaned-on-my-community-for-support-barriers-challenges-and-coping, USENIX/2024/invisibility-cloak-proactive-defense-against-visual-game-cheating, USENIX/2024/stop-dont-click-here-anymore-boosting-website-fingerprinting-by-considering-sets, WWW/2024/are-adversarial-phishing-webpages-a-threat-in-reality-understanding-the-users-pe, CCS/2025/exploiting-the-shared-storage-api, IEEE-SP/2025/blind-users-really-do-heed-aural-telephone-scam-warnings, IEEE-SP/2025/eucleak-side-channel-attack-on-the-yubikey-5-series-revealing-and-breaking-infin, IEEE-SP/2025/its-time-time-for-digital-security-an-end-user-study-on-actionable-security-and, PETS/2025/rethinking-fingerprinting-an-assessment-of-behavior-based-methods-at-scale-and-i, USENIX/2025/im-regretting-that-i-hit-run-in-situ-assessment-of-potential-malware, PETS/2026/contextual-intent-activists-privacy-considerations-for-collaborative-technology, PETS/2026/reportor-facilitating-user-reporting-of-issues-encountered-in-naturalistic-web-b, PETS/2026/websp-eval-evaluating-web-agents-on-website-security-and-privacy-tasks, WWW/2026/what-is-your-ai-agent-buying-evaluation-biases-model-dependence-emerging-implica

## browserbase — 45 papers dropped
   CCS/2010/an-empirical-study-of-privacy-violating-information-flows-in-javascript-web-appl
     …ipt, web application, dynamic analysis, rewriting, history sniffing 1. INTRODUCTION JavaScript has enabled the deployment of rich browserbased applications that are fashioned from code sourced Permission to make digital or hard copies of all or part of this work for personal or classroom use is gran…
   IMC/2010/performance-comparison-of-3g-and-metro-scale-wifi-for-vehicular-network-access
     …s incurred only once at the beginning. This also allows us to retain the same TCP socket across associations. Optimum WiFi uses a browserbased authentication for the initial network access. This is done manually. Again this step is needed only once. Authentication is retained across associations. Fi…
   CCS/2011/app-isolation-get-the-security-of-multiple-browsers-with-just-one
     …l types of web sites, many sites with high-value user data can opt in to app isolation to gain defenses against a wide variety of browserbased attacks. We implement app isolation in the Chromium browser and verify its security properties using finite-state model checking. We also measure the perform…
   … and 42 more: CCS/2011/fortifying-web-based-applications-automatically, IEEE-SP/2011/repriv-re-imagining-content-personalization-and-in-browser-privacy, CCS/2013/protecting-sensitive-web-content-from-client-side-vulnerabilities-with-cryptons, CCS/2013/unauthorized-origin-crossing-on-mobile-platforms-threats-and-mitigation, IEEE-SP/2015/surroundweb-mitigating-privacy-concerns-in-a-3d-web-browser, CCS/2018/minesweeper-an-in-depth-look-into-drive-by-cryptocurrency-mining-and-its-defense, IEEE-SP/2018/mobile-application-web-api-reconnaissance-web-to-mobile-inconsistencies-vulnerab, USENIX/2018/wpse-fortifying-web-protocols-via-browser-side-security-monitoring, CCS/2019/just-the-tip-of-the-iceberg-internet-scale-exploitation-of-routers-for-cryptojac, IEEE-SP/2019/exploiting-correcting-codes-on-the-effectiveness-of-ecc-memory-against-rowhammer, NDSS/2019/master-of-web-puppets-abusing-web-browsers-for-persistent-and-stealthy-computation, USENIX/2019/inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cryptojacking, USENIX/2020/sunrise-to-sunset-analyzing-the-end-to-end-life-cycle-and-effectiveness-of-phish, IEEE-SP/2021/they-would-do-better-if-they-worked-together-the-case-of-interaction-problems-be, NDSS/2021/minos-a-lightweight-real-time-cryptojacking-detection-system, PETS/2021/managing-potentially-intrusive-practices-in-the-browser-a-user-centered-perspect, PETS/2021/residue-free-computing, NDSS/2022/auto-draft-242, NDSS/2022/drawn-apart-a-device-identification-technique-based-on-remote-gpu-fingerprinting, USENIX/2022/behind-the-tube-exploitative-monetization-of-content-on-youtube, CCS/2023/i-just-stopped-using-one-and-started-using-the-other-motivations-techniques-and, CCS/2023/ileakage-browser-based-timerless-speculative-execution-attacks-on-apple-devices, USENIX/2023/checking-passwords-on-leaky-computers-a-side-channel-analysis-of-chromes-passwor, USENIX/2023/hot-pixels-frequency-power-and-temperature-attacks-on-gpus-and-arm-socs, USENIX/2023/r-b-ransomware-over-modern-web-browsers, USENIX/2023/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers, IEEE-SP/2024/sticky-tags-efficient-and-deterministic-spatial-memory-error-mitigation-using-pe, NDSS/2024/compromising-industrial-processes-using-web-based-programmable-logic-controller-malware, USENIX/2024/less-defined-knowledge-and-more-true-alarms-reference-based-phishing-detection-w, USENIX/2024/sync-sync-a-covert-channel-built-on-fsync-with-storage, WWW/2024/detecting-and-understanding-self-deleting-javascript-code, WWW/2024/fusionrender-harnessing-webgpus-power-for-enhanced-graphics-performance-on-web-b, CCS/2025/how-to-design-secure-honey-vault-schemes, IEEE-SP/2025/rankguess-password-guessing-using-adversarial-ranking, IEEE-SP/2025/security-analysis-of-master-password-protected-password-management-protocols, IEEE-SP/2025/tiktag-breaking-arms-memory-tagging-extension-with-speculative-execution, PETS/2025/lost-in-translation-exploring-the-risks-of-web-to-cross-platform-application-mig, USENIX/2025/url-inspection-tasks-helping-users-detect-phishing-links-in-emails, NDSS/2026/continuous-user-behavior-monitoring-using-dns-cache-timing-attacks, PETS/2026/privacy-vs-profit-the-impact-of-googles-manifest-version-3-mv3-update-on-ad-bloc, PETS/2026/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-w, WWW/2026/egocentric-co-pilot-web-native-smart-glasses-agents-for-assistive-egocentric-ai

## browser-use — 14 papers dropped
   CCS/2011/scriptgard-automatic-context-sensitive-sanitization-for-large-scale-legacy-web-a
     …se is based on autotion to the switch and for when the network simulator is in matic server-side sanitizer placement, rather than browseruse configured to simulate an 802.11 connection. Our results based white-listing of scripting in server output. XSSshow that while the runtime overhead of the full…
   USENIX/2016/internet-jones-and-the-raiders-of-the-lost-trackers-an-archaeological-study-of-w
     …ll as popups, and we visit the set of sites twice: once to prime the cache and the cookie store (to avoid artifacts of first-time browser use), and once for data collection. During these visits, we collect the following information relevant to third-party web tracking and store it in a local databas…
   IEEE-SP/2020/meddling-middlemen-empirical-analysis-of-the-risks-of-data-saving-mobile-browser
     …fic that generated it. To assess whether the Puffin proxies modify content, we leverage the fact that Puffin and the stock Chrome browser use the same rendering technology. Thus, we manually perform a visual comparison between the same site rendered by Chrome in normal operation mode and Puffin. Fur…
   … and 11 more: USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing, CCS/2022/exposing-the-rat-in-the-tunnel-using-traffic-analysis-for-tor-based-malware-dete, PETS/2022/increasing-adoption-of-tor-browser-using-informational-and-planning-nudges, IEEE-SP/2023/webspec-towards-machine-checked-analysis-of-browser-security-mechanisms, USENIX/2023/policycomp-counterpart-comparison-of-privacy-policies-uncovers-overbroad-persona, USENIX/2023/pool-party-exploiting-browser-resource-pools-for-web-tracking, PETS/2024/generalizable-active-privacy-choice-designing-a-graphical-user-interface-for-glo, PETS/2024/onion-services-in-the-wild-a-study-of-deanonymization-attacks, WWW/2024/phishinwebview-analysis-of-anti-phishing-entities-in-mobile-apps-with-webview-ta, USENIX/2025/posthammer-pervasive-browser-based-rowhammer-attacks-with-postponed-refresh-comm, PETS/2026/reportor-facilitating-user-reporting-of-issues-encountered-in-naturalistic-web-b

## multion — 4 papers dropped
   CCS/2018/how-you-get-shot-in-the-back-a-systematical-study-about-cryptojacking-in-the-rea
     … whole pro-Cryptocurrency mining services with explicit user notificacess of cryptocurrency mining relies on the collaboration of multion. Our study reveals that some cryptocurrency mining services, tiple participants, including Miner Deployers, Distributors, as such as Coinhive, are abused to launc…
   NDSS/2020/flowprint-semi-supervised-mobile-app-fingerprinting-on-encrypted-network-traffic
     …ly used to recognize Setting a system-wide proxy or VPN connection for all apps the same apps later on, if an unseen app produces multion the device (1) requires manual confirmation by the user; ple fingerprints, F LOW P RINT recognizes each fingerprint as and (2) would be recognizable as unusual de…
   IMC/2025/understanding-and-characterizing-intermediate-paths-of-email-delivery-the-hidden
     …y on that 90% of DNS forwarders depend on only 5% of public resolvers. third-party middle node providers, and 9.1M (8.7%) involve multi-On the authoritative service side, many studies have examined the ple providers. Email signature and security filtering vendors are centralization of domain hosting…
   … and 1 more: IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents

## autogen — 3 papers dropped
   CCS/2017/identifying-open-source-license-violation-and-1-day-security-risk-at-large-scale
     …he top-level source dir of OSS project repos. C/C++ OSS sources also typically host build automation scripts (e.g., configure and autogen in toplevel source dirs. As such, cloned third-party OSS sources are likely to retain these files, which can be used to identify internal OSS clones. However, sin…
   USENIX/2026/autonomy-comes-with-costs-detecting-denial-of-service-vulnerabilities-caused-by
     …LangFlow 81.4k 96.6k 0/4 123 49 2 RagFlow 60.1k 75.1k 0/2 235 40 5 nent ultimately identified 2025 potential vulnerable operators Autogen 46.4k 88.5k 0/1 75 23 14 across the 20 agents. Among them, short-lived, long-lived, Quivr 38.1k 6.1k 0/0 11 1 2 LangChatchat 35.3k 16.1k 0/2 18 3 5 and full-lifec…
   USENIX/2026/masleak-investigating-and-exposing-intellectual-property-leakage-vulnerabilities
     …behaviors," in ICLR, 2024. 4 [57] Q. Wu, G. Bansal, J. Zhang, Y. Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu et al., "Autogen: Enabling next-gen llm applications via multi-agent conversation," in ICLR 2024 Workshop on Large Language 7 Model (LLM) Agents. 8 [58] R. Wen, Z. Li, M. Backes, …

## webarena — 1 papers dropped
   WWW/2016/remedying-web-hijacking-notification-effectiveness-and-webmaster-comprehension
     …duced by blackhat cloaking [26]; and Borgolte detected common symptoms of defacement [3]. These same strategies extend beyond the web arena to detecting account hijacking, where prior work relied on identifying anomalous usage patterns or wide-scale collusion [7, 22]. More recently, Vasek et al. exa…

## langchain — 1 papers dropped
   WWW/2025/understanding-and-detecting-file-knowledge-leakage-in-gpt-app-ecosystem
     …ow how unsanitized prompts can lead to harmful SQL queries, posing a threat to database security in systems using frameworks like Langchain. Previous works primarily focus on attacking LLMs' training data and inference capabilities through prompt manipulation. In contrast, we first construct a harmf…

node scripts/llm_agents_quotecheck.mjs

15 quotes checked across the 'LLM browser agents' family
  exact:   3
  partial: 3  (>=60% of 5-word windows)
  below:   9   <- read these by hand
  no full text on disk: 0

--- below threshold / unreadable ---
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   Skyvern: 21% of 14 windows — "we evaluate four commercial agents (Skyvern, DoBrowser, BrowserUse, and Agent-E) and two academic web agents (WebArena and VisualWebArena)"
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   DoBrowser: 21% of 14 windows — "we evaluate four commercial agents (Skyvern, DoBrowser, BrowserUse, and Agent-E) and two academic web agents (WebArena and VisualWebArena)"
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   BrowserUse: 21% of 14 windows — "we evaluate four commercial agents (Skyvern, DoBrowser, BrowserUse, and Agent-E) and two academic web agents (WebArena and VisualWebArena)"
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   Agent-E: 21% of 14 windows — "we evaluate four commercial agents (Skyvern, DoBrowser, BrowserUse, and Agent-E) and two academic web agents (WebArena and VisualWebArena)"
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   WebArena: 21% of 14 windows — "we evaluate four commercial agents (Skyvern, DoBrowser, BrowserUse, and Agent-E) and two academic web agents (WebArena and VisualWebArena)"
IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
   VisualWebArena: 21% of 14 windows — "we evaluate four commercial agents (Skyvern, DoBrowser, BrowserUse, and Agent-E) and two academic web agents (WebArena and VisualWebArena)"
WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of
   AgentLab: 44% of 9 windows — "The agent uses the AgentLab library and is executed within the BrowserGym framework."
WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of
   BrowserGym: 44% of 9 windows — "The agent uses the AgentLab library and is executed within the BrowserGym framework."
USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
   Browser Use: 30% of 10 windows — "We built a prototype tool using Playwright and the agentic LLM-based Browser Use framework."

All nine below-threshold quotes were then read by hand against data/fulltext/<year>/<venue>/<slug>/paper.cols.txt, and all nine are present in the source. Each fails for one of two mechanical reasons — the extraction dropped bracketed citation markers, or the two-column reading order interleaved the sentence. The source text, so the adjudication can be checked rather than taken on trust:

No quote in this family was found to be unsupported.

Most of the content page's numbers do not come from the extraction at all: they are results the four instrument papers and their neighbours report. An ALLOW list would only record that such a number came from somewhere else. verify_llm_agents_figures.mjs checks that it is actually there, by matching a regex against the paper's own decolumnised full text, and printing the matched span so a reader can see it.

node scripts/verify_llm_agents_figures.mjs

49 of 49 matched. Two things about how it got there are worth recording:

• The first version used unbounded .* between clauses. Greedy matching made one check “pass” by spanning 23,024 characters of a PDF — the two halves of Table 8 in [5Ramesh, Guruprasad Viswanathan; Nayak, Asmit; Siddique, Basieem; Fawaz, Kassem (2026): "WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks", Proceedings on Privacy Enhancing Technologies 2026(4):666-702. (DOI)] really are that far apart once the decolumniser interleaves them with body text. The claim was true; the check was not evidence for it. Every wildcard is now bounded to 400 characters and the longest surviving match is 413 characters.
• The page originally said the gap between [2Sun, Chen; Vekaria, Yash; Nithyanand, Rishab (2026): "On the Suitability of LLM-Driven Agents for Dark Pattern Audits", Proceedings on Privacy Enhancing Technologies 2026(4):927-946. (DOI)]'s self-reported and verified completion was “14 points”. That subtracts 81% (overall, verified) from 95% (one phase, self-reported), and the paper labels its phases inconsistently between §4 and §5.1. The page now prints the numbers side by side and never subtracts them, with a footnote saying why. The verifier prints the same warning instead of the arithmetic.

58 paper-sourced figures checked against paper.cols.txt
  matched: 58
  FAILED:  0

--- matched source text, per claim ---

## PETS/2026/on-the-suitability-of-llm-driven-agents-for-dark-pattern-audits
  [456 data broker sites]
     "456 data broker"
  [browser-use v0.9.5]
     "browser-use framework (v0.9.5)"
  [GPT-5 as the model]
     "from the GPT-5 LLM"
  [headless Chrome via Playwright on a California-hosted server]
     "deployed on a California-hosted server. It processes one broker at a time using a headless Chrome browser controlled through Playwright"
  [is_successful flag reported 95% and 89%]
     "task completion rate of 95% in Phase 2 and 89% in Phase 3"
  [verified completion 81% overall, 87% and 79% by phase]
     "complete 81% of all workflows using the defined interaction protocol (87% in Phase 1 and 79% in Phase 2)"
  [runs reporting a failure are unsuccessful despite the flag]
     "treated as unsuccessful, even if the internal is_successful flag indicates completion"
  [about $0.52 and 287k tokens per broker]
     "average cost of approximately $0.52 (≈287k tokens) per data broker"
  [prompt ablation L1..L4 accuracy and precision]
     "L1: Zero-shot 70.8 61.0 L2: Zero-shot + Role 63.6 49.9 L3: Few-shot + Role 83.5 79.9 L4: Few-shot + Role + CoT 86.7 88.0"
  [prompt ablation recall / F1 / explanation accuracy]
     "60.1 60.5 78.1 73.3 59.4 71.1 74.0 76.9 95.8 74.4 80.7 98.5"
  [role framing cost 7.1 accuracy and 11.1 precision]
     "L1→L2 (+Role) −7.1∗ [−14.7, 0.0] −11.12∗"
  [role framing was counter to expectation]
     "counter to the common expectation that role framing improves overall task performance"
  [annotators' Cohen's kappa 51.9%]
     "yielding 𝜅 = 51.9%"
  [100-broker hand-annotated ground truth]
     "100 data brokers in the ground truth dataset"
  [single-run observation, variability not evaluated]
     "We do not evaluate output variability across repeated runs, and our results should be interpreted as a single-run observation"
  [security_barrier failure category names CAPTCHA and Cloudflare]
     "security_barrier: website actively blocks automation (CAPTCHA, Cloudflare)"
  [failure distribution: automation instability 26.7%, security barriers 25.8%, together 52.5%]
     "automation instability accounts for 26.7% of all failures and security barriers (e.g., CAPTCHAs) account for 25.8%. Together, these account for 52.5% of all failed workflow executions"
  [agent instability, the model's own reasoning, is 5.1%]
     "Internal agent instability represents a small fraction (5.1%) of failed workflows"
  [automation instability is browser crashes, network instability and timeouts]
     "These include unexpected browser crashes, network instability, and execution timeouts"
  [content-format failures are things like PDFs]
     "typically when relevant instructions are embedded in formats such as PDFs which our agent is unable to interact with"
  [six failure categories, not five]
     "these six predefined categories"
  [interaction failures 24.4%]
     "Interaction failures account for 24.4% of all incomplete workflows"
  [navigation failures 10.1% and content format 7.8%]
     "Navigation failures account for an additional 10.1% of failures, reflecting cases where the agent is unable to operationalize the defined interaction protocol. Content format limitations contribute to 7.8%"
  [a better model will not recover the infrastructure failures]
     "even a perfectly calibrated dark pattern classifier would remain unable to evaluate these workflows without modifications to the underlying system infrastructure and agent-website interaction mechanics"
  [refused evasive crawling techniques]
     "We deliberately avoided evasive crawling techniques (e.g., disguised user agents or proxy rotation)"

## USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
  [Playwright plus the Browser Use framework]
     "prototype tool using Playwright [34] and the agentic LLMbased Browser Use framework"
  [five randomly selected sites, succeeded on one]
     "randomly selected five passkey-enabled websites. We built a prototype tool using Playwright [34] and the agentic LLMbased Browser Use framework [14]. The tool attempted to execute passkey registrations, authentications, and deletions without any manual steps. In practice, it succeeded on only one of the five sites"
  [obstacle list]
     "(1) customized UIs, (2) confirmation prompts, (3) password re-entry, (4) 2FA checks"
  [refused automatic CAPTCHA solvers]
     "we did not use automatic CAPTCHA solvers, since this would bypass protections designed to prevent automation"

## PETS/2026/redefining-website-fingerprinting-attacks-with-multi-agent-llms
  [Claude Computer Use API drives the browser]
     "executes these commands inside a real browser using Claude's Computer Use API"
  [20 sites, 30 users, nine WFP models]
     "traffic collected from 20 modern web- Figure 1: We collect WFP traffic dataset generated by real sites browsed by 30 users, we evaluate nine state-of-the-art WFP"
  [under 10% accuracy trained on scripted, tested on human]
     "models achieve under 10% accuracy when trained only on scripted traffic and tested on human traffic"
  [LLM-generated traces reach the 80% range]
     "training with LLMgenerated traces boosts accuracy into the 80% range"
  [$35 per GB human, $10 per GB synthetic]
     "acquiring 1GB of authentic human browsing data costs approximately $35, primarily due to participant compensation and lab infrastructure. In comparison, 690 Redefining Website Fingerprinting Attacks with Multi-Agent LLMs Proceedings on Privacy Enhancing Technologies 2026(3) our LLM-based multi-agent framework can generate 1GB of syn- 3.1 Attacker Capabilities thetic-but human-like-traffic for just $10"

## WWW/2026/mcp-vs-rag-vs-nlweb-vs-html-a-comparison-of-the-effectiveness-and-efficiency-of
  [AgentLab agent executed within BrowserGym]
     "uses the AgentLab library and is exe-NLWeb Architecture: The NLWeb interface extends the MCP cuted within the BrowserGym framework"
  [F1 0.67 HTML vs 0.75-0.77, 241k vs 47k-140k tokens, 291s vs 50-62s]
     "F1 rises from 0.67 for HTML to between 0.75 and 0.77 for the other This paper fills that gap by presenting an experimental comagents. Token usage falls from about 241k for HTML to between parison of the four architectures along an e-commerce use case 47k and 140k per task. The runtime per task drops from 291 seconds that requires agents to search within several e-shops for products to between 50 and 62 seconds"
  [best configuration RAG with GPT-5, F1 0.87, completion 0.79]
     "RAG with GPT 5 achieving an F1 score of 0.87 and a completion rate shops, and finally order the chosen products [8]. of 0.79"
  [the testbed is four simulated e-shops]
     "testbed consists of four simulated e-shops"

## PETS/2026/websp-eval-evaluating-web-agents-on-website-security-and-privacy-tasks
  [200 task instances across 28 websites]
     "task dataset of 200 task instances across 28 websites"
  [eight web agent instantiations evaluated]
     "We evaluate a total of 8 web agent instantiations"
  [Gemini-3-Pro 84.5% with navigation and 82.5% without]
     "achieving an 84.5% success rate with navigation and 82.5% without"
  [Gemini-2.5-Flash: 16.5% is a RELATIVE difference, 21 instances]
     "The biggest performance drop from WithNav to W/oNav is for Gemini-2.5-Flash, with a relative difference of 16.5% (21 instances)"
  [per-model instance counts without navigation: Gemini-3-Pro 165, Gemma-3-27b 40]
     "Gemini-3-Pro-Preview 169 24 7 165 26 9 Claude-Haiku-4.5 117 27 56 106 25 69 Claude-Sonnet-4.5 117 32 51 122 29 49 GPT-5-Mini 91 23 86 87 32 81 GPT-5.1 108 65 27 88 85 27 Gemma-3-27b 50 128 22 40 128 32"
  [pass@k table row: Gemini-3.1-Pro pass@3 0.90, pass_3 0.51]
     "Gemini-3.1-Pro 98 0.71 0.84 0.90 0.58 0.51"
  [pass@k table row: Gemma-3-27b pass@3 0.27, pass_3 0.02]
     "Gemma-3-27b 188 0.12 0.20 0.27 0.04 0.02"
  [that table is Table 8, pass@k and pass_k over three trials]
     "Table 8: pass@𝑘, pass𝑘 scores for k=1,2,3 across three trials"
  [the robustness subset is trial-1 failures plus 2 successes per website]
     "comprising all failures from trial 1 along with a sample lead to uniformly low success rates. For instance, GPT-5-mini is able of 2 successful tasks instances per website"
  [Gemini-3-Pro was discontinued mid-study]
     "As Gemini-3-Pro was Menu in 1 instance. Furthermore, stateful elements like Toggle (98 discontinued, we use Gemini-3.1-Pro"
  [undetected chromedriver and automatic captcha solvers]
     "we use the undetected For elements like radio buttons or dropdowns, where only one chromedriver [72] and automatic captcha solvers [61] in the setup element in a group can be active at a time, we initialize 𝑆 0 with to help avoid bot detection"

## IEEE-SP/2026/investigating-the-impact-of-dark-patterns-on-llm-based-web-agents
  [six agents across three LLMs]
     "six popular LLM-based generalist web agents across three trial of a premium membership. It might feature a prominent LLMs"
  [41% susceptibility with a single dark pattern present]
     "susceptible to that dark pattern 41% of the time"
  [higher-performing agents are the most vulnerable]
     "higher-performing agents being the most vulnerable"
  [best countermeasure prompts drop susceptibility by ~32%]
     "these prompts only dropped agent dark pattern susceptibility by an average of around 32"
  [vision lowered task success and raised susceptibility]
     "decreases in task success rates and increases in dark pattern susceptibility when vision was turned on"
  [TrickyArena is four React-based sites]
     "TrickyArena, a custom testbed of four React-based websites"

## USENIX/2026/network-level-prompt-and-trait-leakage-in-local-research-agents
  [Browser-Use default Google search triggers reCAPTCHA, switched to Bing]
     "it Table 14: Prompt recovery: example selection strategies. issues Google queries via search_web, which frequently triggers reCAPTCHA; we therefore configure it to use Bing with Ex Selection LLM- OBELS automatic fallback"
  [GPT Researcher, AutoGen and Browser-Use are the agents run]
     "we collect traces from GPT-Researcher, AutoGen, and Browser-Use"

## IEEE-SP/2026/parasites-in-the-toolchain-a-large-scale-analysis-of-attacks-on-the-mcp-ecosyste
  [MCP Server Crawler collects GitHub links, not an agent]
     "we implemented the MCP Server Crawler to leverage these links as the entry point for data collection"

DERIVED figures (arithmetic on a checked figure, shown so it is auditable):
  456 sites x $0.52 = $237  -> page says "roughly $240 for one pass"
  10,000 sites x $0.52 = $5200  -> page says "around $5,200 per pass"
  95% / 89% (flag) and 81% overall (verified) are printed side by side, never subtracted.
  86.7 - 63.6 = 23.1 -> page says "23 points of accuracy" (best minus worst prompt config)
  165/200 - 40/200 = 62.5 pp -> page says "a spread of 62.5 percentage points"
  169->165 = 4 instances, 84.5% -> 82.5%; 127->106 = 21 instances -> page quotes both
  21/127 = 16.5% relative; 21/200 = 10.5 pp -> page's footnote says 10.5 pp
  (0.90 - 0.51) / 0.90 = 43% -> page says "roughly two in five tasks it could do at all"

scripts/external_checks_llm_agents.sh, run 2026-08-29. GitHub REST API for repository state, both /releases/latest and /tags (a tag-only repository 404s on the first), PyPI for the package, IETF Datatracker for the drafts.

run date: 2026-08-29T06:36:51Z
github rate limit: 33 remaining, need ~31, resets 2026-08-29T07:36:05Z
== github.com/browser-use/browser-use
   status: ok
   archived: False | pushed: 2026-08-29T02:08:30Z | stars: 111599 | license: MIT
   desc: 🌐 Make websites accessible for AI agents. Automate tasks online with ease.
   latest release: 0.13.8 2026-08-16T18:48:54Z
   newest tags:    0.13.8, 0.13.7, 0.13.6, 0.13.5, 0.13.4
== github.com/ServiceNow/BrowserGym
   status: ok
   archived: False | pushed: 2026-07-17T18:09:30Z | stars: 1333 | license: NOASSERTION
   desc: 🌎💪 BrowserGym, a Gym environment for web task automation
   latest release: v0.14.3 2026-01-20T20:23:26Z
   newest tags:    v0.14.3, v0.14.3.dev4, v0.14.3.dev3, v0.14.3.dev1, v0.14.3.dev0
== github.com/ServiceNow/AgentLab
   status: ok
   archived: False | pushed: 2026-07-17T18:09:43Z | stars: 627 | license: NOASSERTION
   desc: AgentLab: An open-source framework for developing, testing, and benchmarking web agents on diverse tasks, designed for s
   latest release: v0.4.2 2026-01-20T20:27:43Z
   newest tags:    v0.4.2, v0.4.1, v0.4.1rc2, v0.4.1rc1, v0.4.1.dev2
== github.com/Skyvern-AI/skyvern
   status: ok
   archived: False | pushed: 2026-08-29T00:41:54Z | stars: 22876 | license: AGPL-3.0
   desc: Automate browser based workflows with AI
   latest release: v1.0.51 2026-08-24T20:25:08Z
   newest tags:    v1.0.51, v1.0.50, v1.0.49, v1.0.48, v1.0.47
== github.com/browserbase/stagehand
   status: ok
   archived: False | pushed: 2026-08-29T03:03:37Z | stars: 24092 | license: MIT
   desc: The SDK For Browser Agents
   latest release: @browserbasehq/stagehand@3.7.3 2026-08-28T14:46:59Z
   newest tags:    v4-spike-final, v2.2.0, v2.1.0, v2.0.0, v1.14.0
== github.com/microsoft/playwright-mcp
   status: ok
   archived: False | pushed: 2026-08-28T22:44:41Z | stars: 36594 | license: Apache-2.0
   desc: Playwright MCP server
   latest release: v0.0.79 2026-08-06T00:15:56Z
   newest tags:    v0.0.79, v0.0.78, v0.0.77, v0.0.76, v0.0.75
== github.com/web-arena-x/webarena
   status: ok
   archived: False | pushed: 2025-11-26T21:16:00Z | stars: 1590 | license: Apache-2.0
   desc: Code repo for "WebArena: A Realistic Web Environment for Building Autonomous Agents"
   latest release: v0.2.0 2023-10-21T04:35:19Z
   newest tags:    v0.2.0, v0.1.0
== github.com/OSU-NLP-Group/SeeAct
   status: ok
   archived: False | pushed: 2025-02-03T02:09:18Z | stars: 852 | license: NOASSERTION
   desc: [ICML'24] SeeAct is a system for generalist web agents that autonomously carry out tasks on any given website, with a fo
   latest release: v0.2.9.0 2025-01-15T02:56:00Z
   newest tags:    v0.2.9.0, v0.2.8.0, v0.2.7.0, v0.1.0
== github.com/MinorJerry/WebVoyager
   status: ok
   archived: False | pushed: 2024-03-04T03:36:39Z | stars: 1123 | license: Apache-2.0
   desc: Code for "WebVoyager: WebVoyager: Building an End-to-End Web Agent with Large Multimodal Models"
   latest release: Not Found 
   newest tags:    

== PyPI: browser-use
   version: 0.13.8 | requires: <4.0,>=3.11
   uploaded: 2026-08-16T18:50:43

== IETF Web Bot Auth drafts (datatracker)
    draft-meunier-web-bot-auth-architecture rev 05 | state: ['/api/v1/doc/state/4/', '/api/v1/doc/state/150/'] | time: 2026-03-02T20:58:37Z
    draft-meunier-web-bot-auth-glossary rev 01 | state: ['/api/v1/doc/state/2/', '/api/v1/doc/state/150/'] | time: 2025-12-22T07:09:00Z
    bofreq-nottingham-web-bot-authentication rev 00 | state: ['/api/v1/doc/state/159/'] | time: 2025-09-26T16:17:21Z
    slides-124-hackathon-sessd-web-bot-authentication rev 01 | state: ['/api/v1/doc/state/141/', '/api/v1/doc/state/77/'] | time: 2025-11-02T20:03:19Z
    slides-interim-2026-webbotauth-01-sessa-web-bot-auth-use-cases rev 00 | state: ['/api/v1/doc/state/141/', '/api/v1/doc/state/77/'] | time: 2026-04-07T11:02:26Z
    slides-123-webbotauth-vercel-web-bot-auth-use-cases rev 00 | state: ['/api/v1/doc/state/141/', '/api/v1/doc/state/77/'] | time: 2025-07-21T12:06:17Z
    slides-123-webbotauth-web-bot-authentication-bbc-use-cases rev 00 | state: ['/api/v1/doc/state/141/', '/api/v1/doc/state/77/'] | time: 2025-07-21T12:05:53Z
    bofreq-nottingham-web-bot-auth rev 01 | state: ['/api/v1/doc/state/159/'] | time: 2025-09-16T09:49:45Z

== Model Context Protocol: CURRENT PROTOCOL VERSION
   /specification redirects to:
     307 -> https://modelcontextprotocol.io/specification/2026-07-28
   /specification/versioning says:
     The current protocol version is 2026-07-28

== Anthropic client toolsets (release notes are the primary source)
    August 19, 2026 The computer use tool is out of beta on the Claude API as the computer_toolset_20260801 toolset: no beta header, batch actions (several actions in one turn), zoom enabled by default, and per-member configuration through configs . Earlier beta versions remain available. Upgrading an existing integration changes the request shape and tool handling; see Migrate from computer_20251124 . We've launched the browser use tool ( browser_toolset_20260801 ), a client toolset for driving a browser that your app
   browser-use-tool doc: HTTP 200

== What actually drives the browser, per framework (dependency manifests, not docs)
-- browser-use (pyproject at main, and at the tag the one versioned paper used)
    "cdp-use==1.4.5",
   at tag 0.9.5:
         "cdp-use>=1.4.0",
         # "pytest-playwright-asyncio>=0.7.0",  # not actually needed I think
   PyPI requires_dist for the current release:
     ['cdp-use==1.4.5']
-- Skyvern
       "playwright>1.46.0 ; python_version >= '3.12'",
       "playwright==1.46.0 ; python_version >= '3.11' and python_version < '3.12'",
       "playwright>1.46.0 ; python_version >= '3.12'",
       "playwright==1.46.0 ; python_version >= '3.11' and python_version < '3.12'",
       "browser-use-sdk>=3.11.0,<4",
       "playwright>=1.46.0",
-- BrowserGym core
   playwright==1.44
-- Playwright MCP
    {'playwright': '1.63.0-alpha-2026-08-05', 'playwright-core': '1.63.0-alpha-2026-08-05'}
-- Stagehand: the npm dist-tags matter, GitHub /releases/latest does not
   dist-tags: {'latest': '4.0.2', 'alpha': '4.0.3-alpha-a144e1b31166774ed3fa93494032629b2a551f51', 'v3-latest': '3.7.3'}
   latest 4.0.2 published 2026-08-20T01:41:15.959Z | license MIT
   deps: {'zod': '4.4.3', 'chrome-launcher': '^1.2.1', '@browserbasehq/sdk': '^2.16.0', '@opentelemetry/api': '1.9.1', '@opentelemetry/core': '2.9.0'}
   3.7.3 published 2026-08-28T14:49:33.826Z (tagged v3-latest)

What the page took from it:

The page's opening paragraph originally said these frameworks “still drive Chromium through Playwright or CDP”, and the tool table called Browser Use “a Python agent loop over Playwright” — taken from [2Sun, Chen; Vekaria, Yash; Nithyanand, Rishab (2026): "On the Suitability of LLM-Driven Agents for Dark Pattern Audits", Proceedings on Privacy Enhancing Technologies 2026(4):927-946. (DOI)]'s own description of its setup. Checking the dependency manifests rather than the prose changed the paragraph, the table and one of the page's three “things that table is for”:

Two papers describe their Browser Use setup as Playwright-driven. That is not contradicted here — they may have driven Playwright alongside the agent, and the page says so — but it does mean “we used Browser Use” does not identify the control channel, which is the thing crawler asks authors to report. That became a bullet on the page rather than a footnote, because it is the most actionable thing the currency pass produced.

No licence is stated on the page for BrowserGym, AgentLab or SeeAct: the GitHub API returns NOASSERTION for all three, which means its detector could not identify one, not that there is none. Saying “no licence” would be wrong and saying a specific one would be unsourced.

crawler_detection, written 2026-08-29, states that draft-meunier-web-bot-auth-architecture “is marked expired and archived, with no formal standing”. The Datatracker API today returns state Replaced (not Expired) for that document, and its replacement draft-meunier-webbotauth-httpsig-protocol-02 is Active as of 2026-08-19. The content page here states the current position with its own footnote and evidence. The neighbouring page was not edited: a factual correction to a page this run did not otherwise touch should go through that page's own review. Filed as a work item instead.

• A child page rather than a section on crawler. Four crawling papers would normally argue for a paragraph, and the brief for this work said as much. It became a page because the decision a reader faces is disproportionate to the literature: the four papers plus five neighbours have already measured completion rates, per-site costs, prompt sensitivity and run-to-run variance, and none of that fits in a parent-page paragraph without either crowding out the library comparison or being cut to a sentence that says nothing. The parent page keeps a five-line section and a link; the numbers are on the child.
• Instrument / subject / both / baseline is a hand assignment. The schema has usedOrMentioned, which distinguishes used from compared but not used as the tool from used as the specimen. Nine papers is small enough to read, so all nine were, and each assignment is recorded in ROLES[] in the report script with the sentence it rests on — copied from paper.cols.txt, not from the extraction, so the assignment does not inherit the extraction's paraphrasing. The script fails loudly if the fold finds a paper with no assignment, so the table cannot silently go stale.
• “both” is a real category, not a hedge. [6Jeong, Hyejun; Teymoorianfard, Mohammadreza; Kumar, Abhinav; Houmansadr, Amir; Bagdasarian, Eugene (2026): "Network-Level Prompt and Trait Leakage in Local Research Agents", in: Proceedings of the USENIX Security Symposium. (Link)] runs Browser-Use to generate the traffic it then attacks; [7Steiner, Aaron; Peeters, Ralph; Bizer, Christian (2026): "MCP vs RAG vs NLWeb vs HTML: A Comparison of the Effectiveness and Efficiency of Different Agent Interfaces to the Web", in: Proceedings of the ACM Web Conference. (DOI)] runs an AgentLab agent to compare interfaces; [5Ramesh, Guruprasad Viswanathan; Nayak, Asmit; Siddique, Basieem; Fawaz, Kassem (2026): "WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks", Proceedings on Privacy Enhancing Technologies 2026(4):666-702. (DOI)] builds on WebVoyager to benchmark models. In each the agent is both the data-collection tool and part of the object of study. Forcing them either way would have made “instrument” read as 6 or as 3, and the honest number for “used an agent to measure the web” is 3.
• [8Stafeev, Aleksei; Recktenwald, Tim; De Stefano, Gianluca; Khodayari, Soheil; Pellegrino, Giancarlo (2025): "YuraScanner: Leveraging LLMs for Task-driven Web App Scanning", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] is discussed but not counted. It drives Puppeteer with GPT-4 to execute task workflows — an LLM planner, in 2025, before any of the frameworks appear. It folds to the parent page's bespoke crawler, given its own name row, because that is what it is, and giving it a place in the agent family would make the family a mix of “used a named framework” and “wrote something agent-like”, which are different claims about the field. It is on the page as the shape that is currently more common.
• The page does not present a trend line. Nine papers, one in 2025 and eight in 2026, in the two provisional venue-years. A per-year rate would be a graph of the corpus's own incompleteness. The page gives counts and says so.
• The strongest pro-agent evidence was given a section rather than buried. [1Song, Chuxu; Mekala, Dheekshith Dev Manohar; Wang, Hao; Martin, Richard (2026): "Redefining Website Fingerprinting Attacks with Multi-Agent LLMs", in: Proceedings on Privacy Enhancing Technologies, pp. 688-702. (DOI)]'s finding that WFP models trained on scripted-crawler traffic score under 10% on human traffic is, read as methodology, an indictment of scripted crawling for a whole class of question. A page whose verdict is “not yet practice” has to carry its own best counter-evidence prominently, or it is advocacy.
• [9Teoh, Xiwen; Lin, Yun; Li, Siqi; Liu, Ruofan; Sollomoni, Avi; Harel, Yaniv; Dong, Jin Song (2025): "Are CAPTCHAs Still Bot-hard? Generalized Visual CAPTCHA Solving with Agentic Vision Language Model", in: Proceedings of the USENIX Security Symposium. (Link)] is the only 2025 paper and it is a baseline use. Halligan is the authors' own agentic VLM; WebVoyager appears as something to beat. It is counted in Q1 (it names the framework) and excluded from every instrument claim. Without it, the family would be 2026-only.

Four passes, all told explicitly that the author's context might not be exhaustive, and all handed the page text, the scripts, their output and these notes. Findings are logged whether accepted or rejected, because a rejection is the only record of whether a reviewer earned its slot.

The reviewer also reports that every other version, date, licence and link on both pages resolves and checks out, and that no dead links were found.

The same pass reports as clean: the fold tested against all 19,384 distinct tools[].name strings in the corpus (exactly the 14 the page lists match; no Playwright or Puppeteer name is stolen despite the family's precedence; every look-alike including AgentDojo, SWE-Agent and CogAgent folds to residue); independent recomputation of 9-of-5,859 and of the 177-paper LLM-classification table with its year breakdown; byte-for-byte reproduction of three committed outputs; a hand re-check of every bounded-wildcard match in the figure verifier, finding no new instance of the 23,000-character bridging bug; and no cross-population arithmetic.

Clean on this pass: all 11 citekeys resolve to exactly one entry each in the merged 699-entry bibliography; no duplicate key, DOI, URL or title against the 695 live entries; authors, venue, year and DOI verified for the other three new entries; all nine below-threshold quotes in §6 independently re-verified as present in the source; the three evasion-ethics quotes verified verbatim and in context as each paper's actual position; and every figure quoted from Song, Sun, Ersoy and Ramesh re-derived from the source text.

The same pass argues the child page is justified (its reasoning is close to §9's and reached independently), that the body does not undercut the headline, and that every internal anchor and link target it probed resolves.

• 2026-08-29. Whole item in one sitting: fold decision, page, provenance, and the two consequential edits to crawler and crawler. Corpus data/extract/run1, 5,859 papers.
• Scripts written this run: report_llm_agents.mjs, llm_agent_fulltext_probe.mjs, llm_agents_quotecheck.mjs, verify_llm_agents_figures.mjs, external_checks_llm_agents.sh, build_provenance_llm_agents.py (this page). tool_fold.mjs modified.
• Bibliography: 5 entries added (steiner2026_nlweb, jeong2026_network, zhao2026_parasites, ramesh2026_webspeval, chang2026_overcoming), taking the live page from 695 to 700, checked for key, DOI, URL and title collisions against a fresh export before appending — scripts/append_bib_llm_agents.py does the export itself and refuses on any collision, because appending to a stale local copy silently drops anyone else's additions. Seven of the twelve keys the two pages use already existed. chang2026_overcoming was added last, after the generic review pointed out that the ninth paper in every count on the page had no citekey and so could not be identified by a reader. PETS and USENIX index records carry no authors, so ramesh2026_webspeval and jeong2026_network were completed from the venue landing pages with curl and a browser User-Agent.
• This page is generated by scripts/build_provenance_llm_agents.py, which splices the scripts' real output in rather than pasting it, so a refresh is a re-run.
• No discussion block: comments belong on the content page. This follows the convention the first provenance page set.

[1]

Song, Chuxu; Mekala, Dheekshith Dev Manohar; Wang, Hao; Martin, Richard (2026): "Redefining Website Fingerprinting Attacks with Multi-Agent LLMs", in: Proceedings on Privacy Enhancing Technologies, pp. 688-702. (DOI)

[2]

Sun, Chen; Vekaria, Yash; Nithyanand, Rishab (2026): "On the Suitability of LLM-Driven Agents for Dark Pattern Audits", Proceedings on Privacy Enhancing Technologies 2026(4):927-946. (DOI)

[3]

Zhao, Shuli; Hou, Qinsheng; Zhan, Zihan; Wang, Yanhao; Xie, Yuchong; Guo, Yu; Chen, Libo; Li, Shenghong; Xue, Zhi (2026): "Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[4]

Ersoy, Devin; Lee, Brandon; Shreekumar, Ananth; Arunasalam, Arjun; Ibrahim, Muhammad; Bianchi, Antonio; Celik, Z. Berkay (2026): "Investigating the Impact of Dark Patterns on LLM-Based Web Agents", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[5]

Ramesh, Guruprasad Viswanathan; Nayak, Asmit; Siddique, Basieem; Fawaz, Kassem (2026): "WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks", Proceedings on Privacy Enhancing Technologies 2026(4):666-702. (DOI)

[6]

Jeong, Hyejun; Teymoorianfard, Mohammadreza; Kumar, Abhinav; Houmansadr, Amir; Bagdasarian, Eugene (2026): "Network-Level Prompt and Trait Leakage in Local Research Agents", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Steiner, Aaron; Peeters, Ralph; Bizer, Christian (2026): "MCP vs RAG vs NLWeb vs HTML: A Comparison of the Effectiveness and Efficiency of Different Agent Interfaces to the Web", in: Proceedings of the ACM Web Conference. (DOI)

[8]

Stafeev, Aleksei; Recktenwald, Tim; De Stefano, Gianluca; Khodayari, Soheil; Pellegrino, Giancarlo (2025): "YuraScanner: Leveraging LLMs for Task-driven Web App Scanning", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[9]

Teoh, Xiwen; Lin, Yun; Li, Siqi; Liu, Ruofan; Sollomoni, Avi; Harel, Yaniv; Dong, Jin Song (2025): "Are CAPTCHAs Still Bot-hard? Generalized Visual CAPTCHA Solving with Agentic Vision Language Model", in: Proceedings of the USENIX Security Symposium. (Link)