Evidence-Linked Measurement of Indirect Prompt Injection in Web Security Agents: Paired Trials and Application-Specific Evidence Audits

Indirect prompt injection can redirect web security agents, yet an omitted check alone cannot establish attacker influence. We evaluate an application-specific contract integrating exposure chronology, HTTP evidence provenance, application-state verification, and report fidelity. Matched placebo comparisons and controlled analyses examine background failure, verification error, and stopping. Across 420 Qwen3/HarborDesk executions, two payloads yielded six-check placebo-minus-attack losses of 15.28 and 12.50 percentage points. Secondary three-target losses were 10.56, 16.67, and 6.11 points; target coverage under attack matched or exceeded untreated S0. Conditional goal analysis retained only 13 of 60 baseline blocks per payload, limiting precision and generalizability. A 560-session Gemini/GPT-OSS experiment yielded a mean loss of 1.32 points (95% block-bootstrap interval 0.97–1.67), entirely from 19 GPT-OSS/A2 pairs losing C4. After interface correction, 120 stable-tool sessions on independently developed OWASP crAPI confirmed every authorized action, giving zero observed differences across 60 pairs. Strong and simple evaluators agreed on unchanged traces; designed faults differentiated rejection behavior without establishing natural-trace accuracy superiority. The contribution is the operational integration and reproducible testing of this evidence chain using established outcome measures.