---
title: BrowseSafe++: 38,675 paired web pages with prompt injections mostly seen in the wild, plus small detectors for browser agents | ctxsec
url: https://ctxsec.com/items/browsesafe-plus-plus-perplexity-paired-real-world-prompt-injection-benchmark
description: "BrowseSafe++ (arXiv 2610.17457, by Purdue and Perplexity authors) expands the BrowseSafe benchmark from 14,719 pages to 38,675 page pairs. Most of the injections were observed on production websites and are kept unchanged. Each attacked page has a clean copy of the same page, and both come as HTML, Markdown, an accessibility tree and a screenshot. It covers 12 site types, 24 attack types and 18 places on a page. The authors trained BrowseSafe-Guard, two 0.8B-parameter detectors (text and screenshot), which they say beat a frontier-model detector on F1 with low false positives and cost. BrowseSafe-Adapt rewrites injections based on agent feedback: attacks that worked on only a few percent of tasks reached up to 95.41% success once adapted."
status: "research (arXiv 2610.17457, authors include Perplexity researchers)"
published: 2026-11-04
---

> BrowseSafe++ (arXiv 2610.17457, by Purdue and Perplexity authors) expands the BrowseSafe benchmark from 14,719 pages to 38,675 page pairs. Most of the injections were observed on production websites and are kept unchanged. Each attacked page has a clean copy of the same page, and both come as HTML, Markdown, an accessibility tree and a screenshot. It covers 12 site types, 24 attack types and 18 places on a page. The authors trained BrowseSafe-Guard, two 0.8B-parameter detectors (text and screenshot), which they say beat a frontier-model detector on F1 with low false positives and cost. BrowseSafe-Adapt rewrites injections based on agent feedback: attacks that worked on only a few percent of tasks reached up to 95.41% success once adapted.

[← Context & Harness Attacks](/context) · [markdown](/items/browsesafe-plus-plus-perplexity-paired-real-world-prompt-injection-benchmark.md)

research (arXiv 2610.17457, authors include Perplexity researchers)

2026-11-04

### BrowseSafe++: 38,675 paired web pages with prompt injections mostly seen in the wild, plus small detectors for browser agents

- **Why it matters:** paired clean and attacked pages let you measure false positives on the same page. The adaptive results show that defenses scored only against static, replayed injections overstate how well they hold up.
- **If you run browser agents:** test the guard against every view your agent consumes (DOM, accessibility tree, screenshot), not just text, and re-test after attacks are adapted.
- These are the authors' own results and haven't been independently reproduced.

Sources: [arXiv 2610.17457: BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views](https://arxiv.org/abs/2610.17457) · [Perplexity blog: BrowseSafe++](https://www.perplexity.ai/hub/blog/browsesafe-plus-plus)