# BrowseSafe++: a small detector beats frontier models, adaptive attacks win

> BrowseSafe++ measures whether injection detectors hold up once an attacker rewrites the injection using the agent's own feedback.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Benchmark
- **Published by:** Perplexity
- **Disclosed:** 2026-10-12
- **Affects:** AI browser agents, Claude Sonnet 5, GPT-5.5, Gemini 3.1 Pro, Kimi K2
- **Research by:** Yuetian Chen (Perplexity and Purdue University), Kaiyuan Zhang (Perplexity and Rutgers University), Yuntao Du (Perplexity and Purdue University), Thomas Li, Mark Tenenholtz, Perplexity
- **Primary source:** https://arxiv.org/abs/2610.17457
- **Page:** https://theinjection.dev/items/perplexity-browsesafe-plus-plus/

BrowseSafe++ is a 38,675 pair benchmark for prompt injection hidden in web pages, from Perplexity, Purdue and Rutgers. Their 0.8B detector reaches 98.29 F1 on HTML, but rewritten injections still reach 95.41% success on Kimi K2.

## What happened

BrowseSafe++ was published on arXiv on October 12, 2026 by researchers at Perplexity, Purdue University and Rutgers University. The benchmark grows the earlier BrowseSafe set to 38,675 attack and control page pairs, covering 12 website types, 24 attack types and 18 page locations. Perplexity released the SDK on GitHub and the training split on Hugging Face.

## How it works

Each pair is one web page carrying a hidden injection plus a clean copy of the same page, served in three views: raw HTML, Markdown and the accessibility tree. BrowseSafe-Guard, the defense the paper ships, is two 0.8B detectors, one reading text and one reading screenshots. BrowseSafe-Adapt then rewrites each injection using feedback from the target agent, holding the attacker's goal fixed until the agent obeys.

## Who is affected

Any product that lets an agent read untrusted web pages is in scope. The authors tested 16 models as text detectors, 15 of them also as task-executing agents, and seven as adaptive attack targets, among them Claude Sonnet 5, GPT-5.5, Gemini 3.1 Pro, DeepSeek V3.1 and Kimi K2.

## What to do

Test an injection detector against adaptive rewrites, not only against the original injections. The authors report seed injections succeeded on 0.49 to 4.00% of attempts and their rewrites raised that to between 30.66 and 95.41%. The training split and the SDK are public, so a defender can run the same test in house.

## Prompt injection detection, F1 on HTML pages

Higher is better. BrowseSafe-Guard is a 0.8B model; the frontier detectors below it flag 6 to 21% of clean pages.

| Result | Score |
|---|---|
| **BrowseSafe-Guard** (this story) | 98.29F1 |
| GPT-6 Astra | 91.55F1 |
| Claude Fable 5.1 (answered) | 90.44F1 |
| GPT-5.5 | 89.32F1 |
| Jev 1.13 | 89.17F1 |
| Qwen 3.7 Max | 88.96F1 |

Source: https://arxiv.org/html/2610.17457v1

## Quick facts

- **Benchmark:** 38,675 attack and control page pairs, 77,350 pages, 12 website types, 24 attack types, 18 page locations
- **Detector:** BrowseSafe-Guard, two 0.8B models: text 98.29 F1 on HTML at 1.35% false positives, screenshots 93.32 F1 at 6.08%
- **Adaptive attack:** BrowseSafe-Adapt lifted success from 0.49 to 4.00% up to 30.66 to 95.41%, highest against Kimi K2
- **Released:** MIT-licensed SDK on GitHub, 29,500 pair train split on Hugging Face under CC BY 4.0, 9,175 pair test split held for the leaderboard
- **Disclosed:** arXiv v1 on October 12, 2026

## Questions

### Is the BrowseSafe++ dataset free to download?

BrowseSafe++ publishes its 29,500 pair training split on Hugging Face under CC BY 4.0, and the SDK that loads it on GitHub under the MIT license. Perplexity holds back the 9,175 pair test split for a leaderboard at browsesafe.perplexity.ai, where the submission endpoint is listed as coming soon. The full screenshot collection is about 45 GB.

### Does BrowseSafe-Guard beat frontier models at detecting prompt injection?

BrowseSafe-Guard, a 0.8B model, reaches 98.29 F1 on raw HTML with a 1.35% false positive rate, which the paper reports as higher than every frontier detector it tested. GPT-6 Astra scored 91.55 F1 and GPT-5.5 scored 89.32, but both flagged far more clean pages, 14.32% and 20.99% respectively. Perplexity reports the numbers, so treat them as the authors' own measurement.

### Why did the attack success rate reach 95.41% on Kimi K2?

BrowseSafe-Adapt rewrites an injection using feedback from the target agent, keeping the attacker's goal fixed until the agent complies. Against Kimi K2 the authors report success rising to 95.41%, the highest of seven targets, from a seed range of 0.49 to 4.00%. Adaptation success across all targets landed between 30.66% and 95.41%.

## Sources

1. [Paper on arXiv](https://arxiv.org/abs/2610.17457)
2. [Paper Full Text](https://arxiv.org/html/2610.17457v1)
3. [BrowseSafe++ SDK](https://github.com/perplexityai/browsesafe-plus-plus)
4. [Dataset on Hugging Face](https://huggingface.co/datasets/perplexity-ai/browsesafe-plus-plus)