Perplexity open-sources BrowseSafe++, a prompt injection benchmark
A 38,675-page benchmark and a cheap 0.8B-parameter detector for catching prompt injection in browser agents, though Perplexity's own adaptive-attack tests show a determined attacker still gets through most of the time.
Perplexity released BrowseSafe++ on 2 November: an open benchmark and two small detector models for catching prompt injection hidden in the pages a browser agent reads.
The dataset holds 38,675 paired clean and attacked pages, built in part from 1.15 million injections Perplexity’s own Comet agent flagged between September 2025 and September 2026. The detector, BrowseSafe-Guard, is fine-tuned from a 0.8B-parameter Qwen3.5 model and scores around 95% F1, at roughly $0.18 per 1,000 pages screened, against $18.95 to $180.61 for frontier-model APIs doing the same job. The dataset, SDK and detector weights are all public, on GitHub and Hugging Face.
pip install "browsesafe-pp[eval] @ git+https://github.com/perplexityai/browsesafe-plus-plus.git"Why it matters: if you’re building a browser agent, this is a cheap way to screen pages for injection attempts before the agent acts on them, and a free benchmark to test your own defences against.
The caveat: Perplexity’s own adaptive-attack tests, where an attacker got up to 64 tries, found attackers still succeeded 84.2% of the time even with Guard screening every page, down from 93.6% with no detector running at all. Worth deploying for the price, but nowhere near a solved problem.