# Trusted Website API

Web agents usually follow ReAct, choosing each action from page observations that mix trusted and untrusted content, so injected text can rewrite their control flow. Baya compiles the user request into a Python program that calls a Trusted Website API before touching the live site; the planning model never sees live page content, and only the program reads it at runtime. On 581 WebArena Verified tasks Baya reaches 77.8% aggregate utility versus 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct, and on WASP it records a 0% attack success rate against 16.2% and 25.5% for those baselines.

Web agents usually follow ReAct, choosing each action from page observations that mix trusted and untrusted content, so injected text can rewrite their control flow. Baya compiles the user request into a Python program that calls a Trusted Website API before touching the live site; the planning model never sees live page content, and only the program reads it at runtime. On 581 WebArena Verified tasks Baya reaches 77.8% aggregate utility versus 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct, and on WASP it records a 0% attack success rate against 16.2% and 25.5% for those baselines.