BrowseSafe++: webpage injection corpus, detectors and adaptive browser attacks

Evidence record

Paired attacked/clean page benchmark and adaptive browser-agent experiments, including separate answer vs state-change outcomes, false-positive effects and success degradation after attacker feedback.

Read the original source ↗

Claim-level citations (4)

• supportsAdaptive webpage injections bypass page guards while agents finish user tasks: For one evaluated Gemini browser agent, the guard-restricted 64-attempt adapted state-change attack success remained reported as 84.18%, demonstrating degradation under adversarial iteration on that harness.

  Adaptive agent attacks and BrowseSafe-Guard results tables

• supportsAdaptive webpage injections bypass page guards while agents finish user tasks: BrowseSafe++ consists of 38,675 clean/attacked webpage pairs, spanning HTML, rendered and accessibility-related observations; pairs are not all verified successful attacks.

  Dataset construction, pairing and modal coverage

• supportsAdaptive webpage injections bypass page guards while agents finish user tasks: The experiment separately measures attempted or completed unauthorized effects and legitimate task completion; page-guard false positives can block harmless tasks.

  State-changing outcomes, benign guard false positives and completion metrics

• supportsAdaptive webpage injections bypass page guards while agents finish user tasks: The authors report that 182 of 194 successful state-changing injection attacks also completed the legitimate user task, within the controlled evaluation rather than a production attack sample.

  BrowseSafe-Adapt analysis, concluding paragraph before Appendix E; 182 of 194 state-changing successes