Perplexity releases BrowseSafe++ benchmark for browser-agent prompt injection

Perplexity released BrowseSafe++, a benchmark of 38,675 matched attack-and-control webpage pairs designed to help developers test prompt-injection defenses in browser agents. The package includes a gated dataset, an evaluation workflow, a research SDK, a paper and a public leaderboard. Perplexity also described two BrowseSafe-Guard detectors, although the reviewed release materials did not provide downloadable model weights.

The benchmark is split into 29,500 labelled training pairs and 9,175 test pairs, or 77,350 pages in total. Public test inputs contain one label-free page from each pair. Results are scored through the leaderboard instead of distributing the withheld labels.

Indirect prompt injection occurs when instructions embedded in content read by an agent try to override the user’s task or redirect the agent’s actions. In BrowseSafe++, each attacked page is matched with a control that removes the injection while retaining the rest of the page. The records also include a legitimate user task and its expected outcome.

Each pair is available as HTML, Markdown, an accessibility tree and a full-page screenshot. The paper and SDK documentation say the corpus spans 12 page types, 24 attack types, 18 placements, six attacker goals and 80 languages across page content and injection text.

Perplexity and the paper’s authors say 32,187 pairs retain injections observed on production webpages, while 6,488 come from the earlier BrowseSafe benchmark. They describe collecting pages read by a deployed browser agent between Sept. 1, 2025, and Sept. 21, 2026. They then deduplicated the pages, masked personal information, filtered candidates and rewrote surrounding content before reinserting the original injection into the attacked copy. That production provenance has not been independently audited.

The paper describes BrowseSafe-Guard as two binary classifiers fine-tuned from Qwen3.5-0.8B: one for HTML, Markdown or accessibility-tree text, and a multimodal model for screenshots. In the authors’ evaluation, the text detector reached F1 scores of 98.29 on HTML, 93.26 on Markdown and 92.98 on accessibility trees. They reported 93.32 F1 and a 6.08% false-positive rate for the screenshot detector. Those results have not been independently replicated.

The authors estimate that the text detector costs about $0.18 per 1,000 pages using measured rented-H200 GPU time. They compare that with $18.95 to $180.61 for the frontier API models they tested at listed prices. The comparison is an issuer estimate rather than an independent cost audit.

In a separate adaptive-attack experiment covering 1,024 tasks and seven target agents, the authors reported that original injections succeeded between 0.49% and 4.00% of the time. Their BrowseSafe-Adapt method revises injections using feedback from the target agent and raised the reported range to 30.66% to 95.41%. These experimental results have not been independently verified.

The training split is offered under CC BY 4.0. Test inputs carry an evaluation-only license that prohibits training and redistribution. The SDK uses the MIT License, but its repository labels the code a research artifact rather than a Perplexity product and says support or maintenance is not planned. The repository also warns that a benchmark score is not a security guarantee and advises against opening benchmark pages in an agent connected to tools, credentials or real accounts.