Web agents stop deciding mid-page: Baya compiles the task first, cutting injection success to 0%
Synopsis
Web agents usually follow ReAct, choosing each action from page observations that mix trusted and untrusted content, so injected text can rewrite their control flow. Baya compiles the user request into a Python program that calls a Trusted Website API before touching the live site; the planning model never sees live page content, and only the program reads it at runtime. On 581 WebArena Verified tasks Baya reaches 77.8% aggregate utility versus 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct, and on WASP it records a 0% attack success rate against 16.2% and 25.5% for those baselines.
Interpretation
A web agent's action selection no longer depends on page content read at runtime; it is fixed by a program committed before execution. ReAct-style agents hand the latest page observation and the user goal to the model at every step and let it pick the next action, so control flow stays unspecified until runtime. Across 581 WebArena Verified tasks Baya reaches 77.8% aggregate utility, against 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct; on WASP Baya's attack success rate is 0%, versus 25.5% and 16.2% for those baselines.
Baya compiles the task into an executable Python program that reaches the website only through a Trusted Website API. A sandboxed coding agent generates and mock-tests the program without any access to the live site, and a separate engine runs it against the live site afterward. The Trusted Website API is built by hand for each target site, unifying native REST endpoints with Playwright wrappers for UI-only functions behind typed signatures, preconditions, postconditions and error domains.
Untrusted page data can fill program variables or select among branches defined at compile time, but cannot add operations. When execution fails, only error diagnostics explicitly produced by the trusted API implementation return to the compiler for replanning, with at most three retries. Of 627 generated programs, 13 (2.1%) contain a model-call path and 11 (1.8%) invoke it at runtime; in 616 executions (98.2%) retrieved website content never reaches a runtime model.
Perspective
The demonstrated scope is tasks whose control flow can be determined in advance: safe tasks and tasks needing runtime semantic processing whose operations and branches can be fixed beforehand. Evaluation covers four self-hosted WebArena Verified sites and the GitLab and Postmill attack templates in WASP, with Trusted Website APIs built by hand for these fixed environments.
Tasks where runtime data must determine new operations are outside the supported scope. Baya's latency and cost exceed the ReAct baselines, at 327.15 seconds, about 1.37 million tokens and $0.70 per task on average. On some models and sites its benign-task utility falls below ReAct, for example 61.1% for Baya versus 91.7% for API-enabled ReAct on Postmill with Claude Sonnet-4.6.