What changed
Perplexity released BrowseSafe++, an open prompt-injection benchmark built from 38,675 attacked and clean page pairs across HTML, Markdown, accessibility-tree and screenshot views, plus an SDK, public leaderboard and two 0.8B BrowseSafe-Guard detectors.
Why it matters
The paired pages let teams measure both missed attacks and false positives on browser-agent inputs that preserve real injection text while rewriting surrounding private content. That is closer to an operational regression set than synthetic jailbreak prompts alone.
What to do
Request the gated data, pin the SDK, score an existing detector across all four views, record false positives on clean twins, and add adaptive attacks plus an independently reviewed destination-state test before placing the detector in an action path.
Caveat
The benchmark is produced by a vendor that operates browser agents, and the public test labels remain gated. Reported detector and adaptive-attack results are author-run; benchmark performance does not prove that a deployed browser agent will refuse, contain or recover from an injection.