The report
In a controlled test using a Gemini 3.5 Flash-Lite browser agent, BrowseSafe-Guard blocked 94.53% of original injected pages. But after an attacker could revise an injected page up to 64 times, the guarded agent still met the attacker goal on 84.18% of all 1,024 tasks. For the subset of goals requiring a change to application state, the guarded success rate was 66.67%. Those rates are different, and neither is the observed prevalence of successful attacks on the public web.
A good first-pass filter faced a changing attacker
The BrowseSafe++ paper combines 38,675 matched attacked and clean webpage pairs, with four page representations for each pair. The separate BrowseSafe-Adapt procedure seeded an attack with page content and an objective, ran a browser agent in a reset sandbox, then revised failed injections using feedback. The detector inspected each candidate page before the agent read it. If flagged, the page was replaced with a blocking notice.
With the detector, the first attempt succeeded on 1.37% of tasks, compared with 4.00% without it. By eight attempts, those rates reached 60.35% guarded and 78.91% unguarded. At 64 attempts they reached 84.18% and 93.55%. This is cumulative success after multiple adversarial trials, not a single-call jailbreak probability.
| Measured outcome | Without guard | With guard |
|---|---|---|
| All goals, within 64 attempts | 93.55% | 84.18% |
| State-changing goals, within 64 attempts | 82.13% | 66.67% |
| Legitimate clean-task completion | 97.85% | 91.21% |
| Mean attempts including failures | 9.73 | 16.98 |
The linked Case documents both attacker effects and legitimate task outcomes. 182 of 194 successful state-changing attacks also finished the legitimate user task. A final answer that appears useful is therefore not enough to confirm that no unauthorized change occurred.
What the numbers do not say
Perplexity reported 1.15 million pages flagged as suspected injection over its observation period, not 1.15 million verified successful compromises. The benchmark used rewrites to remove private context, and its adaptive success figures are from specified agents and tasks. A guard that sees only the rendered page cannot decide whether the later payment, deletion or account change is authorized by the user.
This distinction points to two independent evaluations: detector quality on attacked versus clean pages, and effect authorization at the destination tool. Reporting only the detector's first-pass block rate misses the adaptive exposure and its cost in false blocks.