Blog post
Our blog post on BrowseSafe++ is live.
BrowseSafe++
Prompt-injection detection
for browser agents.
A benchmark built from real-world injections, with matched attack and control pages.
- Candidate production pages
- 1.15Mcandidate pages collected
- Attack/control pairs
- 38,675attack/control pairs
(77,350 pages) - Attack types
- 24attack types
- Collection period
- 386days of production collection
- Languages
- 80languages
Real injections.
Matched page pairs.
BrowseSafe++ extends BrowseSafe from 14,719 to 38,675 entries. Each pairs an attacked page with a control that differs only by the injection, across HTML, Markdown, accessibility-tree and screenshot views. Original injections are preserved; sensitive surrounding content is rewritten to protect privacy. Every entry includes a legitimate task and expected outcome.
Detection on text views
Adaptive attacks
Attack success before and after revision using browser-agent feedback.
News
Test-split submissions are open
Request access to the dataset on Hugging Face and accept the terms (one request covers the training split and the test inputs, which are licensed for evaluation only), run your detector locally with the SDK and upload the predictions in the leaderboard Space. You receive aggregate scores for each view. One submission per account per week; maintainers review requests to publish, and the leaderboard shows the top five community results per view (F1 of at least 50).
SDK 0.2
browsesafe predict and load_test_inputs() run your detector on the test split and write the predictions file for the leaderboard. Screenshots now come with the dataset itself, and the Hugging Face viewer shows them.
BrowseSafe++ released
The paper, the training split (29,500 attack/control pairs in four views) and the SDK are public. The 9,175-pair test split is reserved for the leaderboard. The leaderboard reports 17 text-view detectors, screenshot detection and adaptive attacks on seven browser agents.
Cite BrowseSafe++
BibTeX
@misc{chen2026browsesafepp,
title = {BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views},
author = {Chen, Yuetian and Zhang, Kaiyuan and Du, Yuntao and Li, Thomas and Tenenholtz, Mark and Polley, Kyle and Ma, Jerry and Yarats, Denis and Li, Ninghui},
year = {2026},
eprint = {2610.17457},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2610.17457}
}