BrowseSafe: Researchers Build a Browser Agent Prompt Injection Benchmark and Evaluate Existing Defenses

Why prompt injection detection fails when browser agents read real webpage tool outputs, and how to stop it on both the architecture and classifier sides.

• Scenario: the authors state that browser agents (such as Comet, Atlas) autonomously complete multi-step web workflows. Untrusted comments and the like entering context may hijack the execution flow, with consequences ranging from disturbing users to compromising sensitive information.
• Existing shortcomings: the authors state that existing evaluations mostly target single-line injections in clean text; real tool outputs are HTML containing benign imperative elements, multiple languages, and close to normal pages. The authors state that no prior work systematically characterizes how these factors affect detection.
• Approach: separate attack targets, HTML positions, and wording; measure detection with BrowseSafe-Bench containing distractors; and build the multi-layer defense BrowseSafe accordingly.
• Threat model:
  • Goal: embed malicious content to force the agent to execute attacker-chosen actions and deviate from the user's task. The authors list harms including click fraud, inducing malware downloads, and leaking user sensitive information.
  • Capability: a website owner, or an adversary who has fully compromised a benign website, can control all delivered content; it can also be a user with posting rights on an uncompromised website, such as product descriptions or forum comments.
  • Knowledge: the paper does not use terms such as white-box or black-box. The untrusted object is the external webpage; the agent receives observations via tool calls.
  • Victim system: the AI browser agent used by the user. Appendix C.2 states that only the agent itself is trusted. The defense scans the text webpages it must process; the same section states that non-text inputs such as images are not processed or evaluated.

Prompt injection attacks

• Text injection: Goodside (2022), Willison (2022), and Liu et al. (2024a), Salem et al. (2023), etc., place malicious instructions in context to change model behavior. Appendix A provides an extended discussion of this.
• Browsers and pages: EIA (Liao et al., 2024) and Fine-Print Injection (Chen et al., 2025a) discuss the impact of environment or page fine print on agents. WASP (Evtimov et al., 2025) discusses instructions in public content; Pop-up (Zhang et al., 2024b) and VPI (Cao et al., 2025) discuss elements such as pop-ups. WebInject (Wang et al., 2025) and VWA-Adv (Wu et al., 2024a) discuss image perturbations.

Detection and training defenses

• Detection models and vendor processes: known-answer detection (Nakajima, 2022; Liu et al., 2024b; 2025b) uses another LLM to distinguish clean from malicious inputs. PromptArmor (Shi et al., 2025b) uses system prompts to require the detection model to judge whether malicious instructions are present. GPT-5 (OpenAI, 2025c) and Claude (Anthropic, 2025a;b) incorporate ignoring injections, detection, and response into training and system processes.
• Fine-tuned classifiers: PromptGuard-2 (Meta, 2025) is a BERT-style model fine-tuned on benign and malicious inputs. gpt-oss-safeguard (OpenAI, 2025d) classifies according to developer policies. StruQ (Chen et al., 2025b) separates prompts and data into channels. Meta SecAlign (Chen et al., 2025d) uses injection samples for supervised fine-tuning.

Architectural defenses

• System-level controls: IsolateGPT (Wu et al., 2024c) isolates execution of untrusted text. AgentSandbox (Zhang et al., 2025) discusses principles such as defense in depth and least privilege. CaMeL (Debenedetti et al., 2025) adds a protective layer outside the model. Progent (Shi et al., 2025a) provides a permission policy language. FIDES (Costa et al., 2025) uses information flow control to discuss formal guarantees. The paper mostly describes this group and does not provide a per-work quantitative comparison with BrowseSafe.

Benchmarks, baselines, and positioning

• Existing benchmarks: Tool-based ones include InjecAgent (Zhan et al., 2024), AgentDojo (Debenedetti et al., 2024), and ASB (Zhang et al., 2024a). Web/GUI-based ones include WASP and WAInjectBench (Liu et al., 2025a); Appendix A states GUI benchmarks often use accessibility trees and screenshots, and WASP is built on VisualWebArena (Koh et al., 2024). The authors state these settings often lack real HTML with benign distractors, diverse injection strategies, and context-aware generation (Table 1, Section 2).
• Baselines and data: Baselines are PromptGuard-2, gpt-oss-safeguard, GPT-5, GPT-5 mini, Haiku 4.5, Sonnet 4.5, and Qwen3-8B fine-tuned on the same training set. The evaluation set is BrowseSafe-Bench.
• Positioning: The authors state that no work yet systematically characterizes how real HTML, distractors, multilingualism, and semantically fused payloads affect detection; the benchmark emphasizes injections that could affect real actions, not just text outputs.

The evaluation instrument is BrowseSafe-Bench, and the defense system is BrowseSafe. The former builds HTML scaffolding from production tool outputs and separates attack targets, placement, and wording; the latter performs trust marking, original-source extraction, chunked classification, and placeholder replacement at tool output boundaries.

Benchmark Principles and Pipeline

• Four principles: nested HTML rather than single-line text; attack targets, strategies, and language styles covered separately; benign distractors morphologically close to attacks; adversaries embedded in webpage content, rather than user-initiated attacks or rewriting system prompts.
• Materials: 100,000 anonymized, desensitized tool outputs sampled from production browser agents, filtered by common domains, quality, and length, used to define scaffolding and variation axes. The 14,719 items are subsequently constructed samples, not these 100,000 items themselves.
• Four steps: extract and anonymize real website text, preserving original HTML rather than accessibility trees; wrap with eight templates; add distractors to both malicious and benign samples; malicious samples are then placed in hidden elements, or visible content is rewritten according to full-page context.
• Rewriting: attacks and distractor rewrites use claude-sonnet-4-5-20250929. Appendix B.6 includes domain extraction, content analysis, context-based rewriting, lookalike domains, and section localization. Appendix B gives attack descriptions and code examples.

Sample Space

• Scale: training set 11,039 items, test set 3,680 items. Dimensions are 11 attack types, 9 injection strategies, 5 distractors, 5 context-aware generations, 5 domains, and 3 language styles.
• Types and strategies: types are Basic, Advanced, Sophisticated. Figure 2 lists Important Message, Todo, InjecAgent, Ignore Previous, URL Segment, Role Manipulation, System Prompt Exfiltration, Delimiter Injection, Social Engineering, Indirect Hypothetical, Multilanguage. Hidden strategies include comments, data attributes, hidden text, hidden form fields, and semantic attributes; visible rewrites target paragraphs, lists, footers, and table cells. Figure 4 additionally marks Inline Paragraph Rewrite Fallback.
• Styles, domains, distractors: language styles are explicit, indirect, stealth, independent of target and position. Appendix B.3 defines the three; stealth requires no attack markers and blending into normal phrasing, with specific banned words not repeated here. Domains are Workspace, Education, Social Media, Entertainment, E-commerce. Distractors insert benign structures with probability; the authors state that otherwise the classifier would bind these structures to maliciousness.

Defense Pipeline

• Trust boundary: tools that may return untrusted content are marked, such as reading webpages, email, calendar, uploaded files; purely computational tools are generally not marked. When a marked tool is invoked, detection runs in parallel with language model planning. The authors state this hides the overhead behind the agent's own latency.
• Preprocessing: AI-generated fields such as summaries and relevance assessments are removed, and only the original tool return is classified. The authors' stated reason is that these fields may already be influenced by untrusted content and cannot be relied on to judge safety.
• Classifier: fine-tuned Qwen3-30B-A3B-Instruct-2507, with 3B activated parameters at inference. One epoch, learning rate 1e-5, weight decay 0.1, data as the above training set.
• Hard negatives: distractors generated by rules similar to attacks and injections, but with benign content. The authors state that without such negatives, the model would memorize the attack vocabulary and generalize poorly to real attacks.

Aggregation, Threshold, and Intervention

• Chunking: when token count exceeds a fixed window Tw, non-overlapping chunks are cut at token boundaries and classified in parallel. The paper gives the symbol Tw without a numeric value, and states that chunking is done only at inference.
• Aggregation: the whole document is judged as result=\bigvee_{i=1}^{n} r_i; if any chunk is judged malicious, the whole document is intervened on.
• Intervention: the malicious return is replaced with a placeholder tool call, stating that interception occurred, without writing details of the malicious content. The authors state this is to avoid the agent being attacked again while explaining to the user, and to avoid outputs being used to improve attacks.
• Threshold and judgment: Appendix C.7 states that the detection model is evaluated at a threshold producing 1% FPR, and considers that raising FPR to 5% or 10% would improve recall. Table 2 does not separately report complete metrics for these three levels. Test metrics are F1, Precision, Recall, Balanced Accuracy, and Refusals. Input is full-page HTML, up to 80k tokens, without truncation. Appendix G gives evaluation prompts for each model family.

Experimental Setup

• Configuration: Section 4 says it compares 23 frontier models. Table 2 has 23 rows: PromptGuard-2's 22M and 86M; gpt-oss-safeguard's 20B/120B and Low, Medium; GPT-5 and GPT-5 mini's Minimal, Low, Medium, High; Haiku 4.5 and Sonnet 4.5's No Thinking, 1K, 8K, 32K; and BrowseSafe. The high reasoning gpt-oss-safeguard was not listed due to generation errors.
• Backbone and baselines: BrowseSafe's base model is Qwen3-30B-A3B-Instruct-2507. Additionally, Qwen3-8B was fully fine-tuned on 11,039 samples with the same one-epoch recipe and compared with its zero-shot version.
• Data and input: Test set 3,680 samples, training set 11,039 samples. Each page is full HTML, up to 80k tokens, not truncated. The rewriting model in the construction phase is claude-sonnet-4-5-20250929.
• Metrics: F1, Precision, Recall, Balanced Accuracy, Refusals. Figure 7 also compares F1 and P50 latency.
• Judgment: Each model does its own binary classification; the paper does not mention a separate judge model. Appendix E says most models have 0 Refusals on 3,680 samples. The paper does not report human agreement or number of repetitions.

Main Results

The table below is based on Table 2, listing only 8 rows, including PromptGuard-2 (22M) with the lowest F1. Not listed: PromptGuard-2 (86M); the other three configurations of gpt-oss-safeguard; the other configurations of GPT-5 and GPT-5 mini; Haiku 4.5's 1K/8K/32K; Sonnet 4.5's No Thinking, 1K, 8K. Figure 1 marks BrowseSafe (Finetuned) as 90.4%, corresponding to 0.904 in the table.

Swipe horizontally to read the table

Model and configuration	F1	Precision	Recall	Balanced Accuracy	Refusals
BrowseSafe	0.904	0.978	0.841	0.912	0
Sonnet 4.5, 32K	0.863	0.935	0.801	0.873	669
GPT-5, Medium	0.855	0.930	0.792	0.867	0
GPT-5 mini, Low	0.854	0.949	0.776	0.868	0
Haiku 4.5, No Thinking	0.810	0.760	0.866	0.798	0
gpt-oss-safeguard, 20B / Medium	0.796	0.994	0.664	0.832	0
gpt-oss-safeguard, 120B / Low	0.730	0.994	0.577	0.788	0
PromptGuard-2, 22M	0.350	0.975	0.213	0.606	0

• Specialized vs. general models: The authors say small specialized classifiers perform poorly, mainly due to low recall; the unlisted 86M has recall 0.221 and F1 0.360. The authors say that among the models evaluated in this study, general reasoning is more effective than these smaller specialized safety classifiers. The two 120B configurations have F1 0.730 and 0.741, lower than the 20B's 0.790 and 0.796; the authors do not explain this.
• Fine-tuning perspective: The authors compare BrowseSafe with Sonnet 4.5 (32K), saying the improvement is mainly driven by precision and balanced accuracy. Insight also writes that recall is especially improved. The unlisted Haiku 4.5 (1K) has recall 0.872, higher than the BrowseSafe row in the table; several specialized models also have higher precision.
• Authors' claims about cost: The authors say that if fine-tuned on this dataset, most tested models would reach or exceed their detection model; this experiment is meant to view benefits and effort together. The authors say PromptGuard-2 is small, and CPU latency can be better than Qwen3-30B-A3B; the paper does not report the latency in seconds.

Distractors, Positions, Languages, and Attack Types

• Distractors: Figure 3 and the text say that with zero distractors, the average balanced accuracy across all models is 90.5%; with three distractors it drops to 81.3%; thereafter it falls between 79.4% and 82.9%. The authors' Remark writes about 10 points (90% to 81%). The authors say this indicates detectors rely on surface patterns and spurious correlations with malicious intent.
• Positions and languages: The numbers are averages across models. In Figure 4, Data Attribute and Form Hidden Field are both 91.6% (n=276, n=104), HTML Comment is 90.9% (n=127). Inline Paragraph Rewrite is 74.0% (n=152), Footer Rewrite is 69.1% (n=15), Table Cell Rewrite is 71.1% (n=2). The authors say visible rewrites have a miss rate nearly double that of hidden injections, and write 69–75% vs. 87–92%; the same figure also has Semantic Abuse 86.8% (n=105) and List Item Rewrite 81.3% (n=9). Figure 5: explicit 84.6% (n=1109), indirect 78.1% (n=340), stealth 75.3% (n=386).
• Attack types: Figure 6 averages over more than 20 detection models; System Prompt Exfiltration is 85.0% (n=156), Multilanguage is 76.0% (n=184). The authors say multilingual is the hardest and believe models rely on English features. The text says the training set has only 184 multilingual samples. Appendix F.2 says footer and table cell samples are few, so results are likely not stable conclusions, but they are kept because they appear in the data.

Latency, Refusals, and Same-Data Fine-Tuning

• Latency: Figure 7's x-axis is P50 Latency (seconds, logarithmic), y-axis is F1 Score. The text says BrowseSafe is in the upper left, F1 above 90%, latency under 1 second; the abstract and conclusion write less than 1 second. The authors say Sonnet 4.5 family latency is 23 to 36 seconds, citing 32K's F1 of 86.3%; GPT-5 and GPT-5 Mini cluster at F1 75–85%, latency about 2 seconds. The authors say high-F1 general API models may not be suitable for synchronous detection.
• Refusals: BrowseSafe, PromptGuard-2, gpt-oss-safeguard, and GPT-5 family have 0 on 3,680 samples. Sonnet 4.5 has 419, 613, 650, 669 (Table 2). The authors say high F1 does not mean every time a usable judgment is given; refusals can be treated as positive class, but if one also needs to output a reason for the positive judgment, there will be difficulties.
• Same data: Qwen3-8B is evaluated on all 3,680 samples, each model taking a 1% FPR threshold individually. F1 ranges from 0.559 to 0.765, recall from 0.392 to 0.626. The authors say the full system still leads by 0.14 F1 and 0.21 recall at the matched operating point. Table 3's standard split baseline is 0.905, which is not the same number as Table 2's 0.904.

Other Ablations and Analyses

• Context window: Haiku 4.5's F1 is 0.810, 0.809, 0.805, 0.808; Sonnet 4.5's 1K/8K/32K are 0.862, 0.863, 0.863, No Thinking is 0.807 (Table 2). The authors say turning off Sonnet 4.5's reasoning reduces detection, while Haiku's configurations are stable.
• GPT-5's four configurations have F1 0.849, 0.854, 0.855, 0.840; GPT-5 mini has 0.750, 0.854, 0.853, 0.852 (Table 2). The authors do not explain why High is lower than Medium.
• Held-out generalization (Table 3): standard split 0.905; held-out URL 0.935; held-out attack type 0.863; held-out injection strategy 0.788. The authors say new websites and unseen attack semantics are better, and unseen injection strategies are the biggest challenge.
• Appendix F heatmap covers more than 20 models, 11 attack types, and 9 strategies. The authors say models' relative highs and lows across attack types are similar; a little reasoning helps, but there is no need to exceed a low reasoning budget.
• Appendix C.8 says models are better on unseen websites and attack styles, but other out-of-distribution changes are worse than frontier LLMs. The paper does not report separate metrics after escalating edge cases to stronger models.

Limitations and future directions noted by the authors

• Non-text inputs: Appendix C.2 states that BrowseSafe has limitations and this paper does not handle or evaluate non-text inputs, such as malicious images or other inputs targeting vision models.
• Other out-of-distribution variations: Appendix C.8 states that the model generalizes well to unseen websites and attack styles, but other out-of-distribution variations are less robust than frontier LLMs; the authors propose escalating edge cases to a slower but stronger reasoning model.
• Signal sharing: Appendix C.9 states that whether passing the raw HTML scanning signal to a downstream tool parameter scanning model improves results requires future work to accurately evaluate.
• Cross-chunk detection: Appendix C.10 states that future work could investigate letting the classifier use hidden states from each chunk to detect attempts that require seeing the whole text, such as a combination of footer text and header script tags.

Experimental coverage

• Data: Test set has 3,680 samples, training set has 11,039 samples. Construction dimensions are 11 attack types, 9 injection strategies, 5 distractors, 5 domains, and 3 language styles (Section 3). Section 3.5 states the training set has 184 multilingual samples.
• Model configurations: Table 2 reports F1, Precision, Recall, Balanced Accuracy, and Refusals for 23 row configurations. Qwen3-8B zero-shot and fine-tuned are also compared on all 3,680 samples at their respective 1% FPR thresholds.
• Analysis axes: Number of distractors (Figure 3), injection strategies (Figure 4), language styles (Figure 5), attack types (Figure 6), and held-out URLs, attack types, and injection strategies (Table 3). Figure 7 compares F1 and P50 latency.
• Task morphology: Appendix C.2 states the evaluation does not include non-text inputs. Table 1 lists Multi-modal (Image) and End-to-end Evaluation as comparison dimensions; the main text metrics are for HTML binary classification, and the paper does not report results for End-to-end Evaluation.
• Missing numbers: The paper does not report the number of repetitions nor agreement between model judgments and human judgments. gpt-oss-safeguard with high reasoning is excluded from Table 2 due to generation errors. Attack and distractor rewrites use claude-sonnet-4-5-20250929 (Appendix B.6).

BrowseSafe is a prompt injection detection defense placed on the output of AI browser agent tools, and the measurement instrument is BrowseSafe-Bench.

• Problem: Agents read untrusted web pages through tools. The authors say that single-line injection evaluations on clean text do not explain why detection fails in real HTML.
• Threat: Attackers control a site, or only post on uncompromised sites. The goal is to make the agent deviate from the user's task. Only the agent is trusted; the defense does not cover non-text inputs such as images.
• Method: 14,719 samples separate attack type, injection location, language style, domain, and distractors. On the defense side, untrusted tools are marked, AI-generated fields are removed, results are aggregated by OR rule after chunking, and malicious returns are replaced with placeholder outputs that do not contain payload details. The classifier is fine-tuned from Qwen3-30B-A3B-Instruct-2507.
• Results: With zero distractors, the cross-model average balanced accuracy is 90.5%, and with three distractors it is 81.3% (Figure 3). The multilingual type is 76.0% (Figure 6). In Table 2, BrowseSafe's F1 is 0.904, Sonnet 4.5 (32K) is 0.863, and PromptGuard-2 (22M) is 0.350. After leaving out injection strategies, F1 is 0.788 (Table 3). The authors say latency is under 1 second.
• Authors' conclusion: The authors say that out-of-the-box frontier LLMs can do this classification, fine-tuning on real data can further improve F1, and they hope the benchmark will be used for more rigorous development and evaluation of browser agents. Recall is not higher than every row in Table 2, for example Haiku 4.5 (1K) is 0.872.