Perplexity has released BrowseSafe++, an open benchmark built from prompt injections that its Comet browser agent ran into on real websites, together with two small detectors trained to spot them. The company’s Secure Intelligence Institute published the work on November 2 in a Perplexity blog post.
A prompt injection here is text planted on a web page that tries to give orders to an AI agent reading the page. If the agent follows it, Perplexity says, it “can return a misleading answer or take an action the user didn’t request.” Browser agents such as the assistant in Comet read pages and act on them for the user, so they are an obvious target.
What Perplexity collected
Between September 2025 and September 2026, Comet’s injection detector flagged 1.15 million injections on pages its agent read. Perplexity built 32,187 benchmark pairs around those injections and added 6,488 pairs from its original BrowseSafe benchmark from December 2025, for 38,675 pairs. Each pair holds an attacked page and the same page without the injection. Perplexity says it masked personal information and rewrote the surrounding page content but kept each attack word for word.
The attacks described in the post do not look like the old “ignore previous instructions” tricks. They pose as sources the agent might trust: the site itself, a security notice, the user’s own preferences or the agent’s developer. One example in the post orders the agent to buy a crypto token and ends with a fake authorization code.
Perplexity reports a few patterns:
- In 24.4% of pairs the injection is in a different language from the rest of the page, usually an English instruction on a non-English page.
- More than four in ten injections push the agent toward an action the user never asked for, and about a third try to make it drop the user’s task. Only about 3% try to plant false information in an answer.
- More than 23,000 injections arrived through content anyone can post, such as forum posts or shared documents. The attacker does not need to control the site.
Two small detectors, and their limits
The detectors, called BrowseSafe-Guard, are two 0.8-billion-parameter models fine-tuned from Qwen3.5-0.8B: one reads page text and one reads screenshots. Perplexity says the text detector reached an F1 score of about 95% on the benchmark and flagged about one clean page in 20. It compared Guard with 18 general-purpose models prompted to do the same job and says Guard was more accurate and much cheaper to run on every page.
The post is also frank about what detection does not solve. When the same models were asked to carry out a task on a page they had already flagged as attacked, every model tested still followed some of those injections.
Perplexity then let an attacker model rewrite failed injections up to 64 times per task. On the first try, the original injections succeeded on at most 4% of tasks against any of the seven agents tested. With rewrites, the attacker succeeded on at least 79% of tasks against five of the seven. Putting Guard in front of one agent blocked 94.5% of the original injections and raised the average number of attempts an attacker needed from 9.7 to 17.0, but the attacker still succeeded on 84.2% of tasks within 64 attempts. Perplexity’s own conclusion is that no detector is “a silver bullet” and that it has to sit inside a layered defense.
Who can use it
The SDK is on GitHub and the dataset is on Hugging Face behind an access request. Teams can score their own detectors on the test split and submit results to a public leaderboard, limited to one scored submission per account per UTC week. All figures above are Perplexity’s own results and have not been independently checked.
For readers, the practical point is simple. An agent that browses for you reads text you never see, and that text can be written for the agent. Watch what an agent is about to buy, send or delete before you approve it. Our page on how AI agents differ from chatbots explains why tool access raises the stakes, and Perplexity’s privacy terms are summarized on our AI privacy pages.
