Search (UI-TARS) — agentic threat model

The agent relies on foundation models (via UI-TARS) that are highly susceptible to indirect prompt injection, as untrusted web search results and rendered page content are fed directly back into the model context, potentially reprogramming its behavior.

Data operations involve ingesting real-time, unvetted web data from multiple search engines. There is a severe risk of data poisoning and ingestion of malicious payloads embedded in web pages that can manipulate the agent's state.

The framework couples search with browser automation tools. Insecure tool integration is a primary threat, where injected instructions from web pages can abuse the browser automation tool to perform unauthorized on-page actions.

Not certain from the listing — The deployment environment requires robust sandboxing for the browser automation component to prevent container escape, local network probing, or host compromise from malicious web pages, but specific sandbox controls are not detailed.

Not certain from the listing — There is no mention of real-time guardrails, input/output filtering, or anomaly detection to identify when the browser automation tool is being manipulated by adversarial web content.

Not certain from the listing — The open-source tool lacks visible authentication, authorization policies, or execution boundaries to restrict what domains or actions the browser automation can interact with.

As part of the UI-TARS agent desktop stack, this agent interacts with other local tools and agents. A compromise of this search agent via web injection can cascade, allowing lateral movement to other agents in the UI-TARS ecosystem.