Training BrowseSafe: Lessons from Detecting Prompt Injection

Kyle Polley, Member of Technical Staff, Security Perplexity, speaks at [un]prompted 2026 on: Training BrowseSafe: Lessons from Detecting Prompt Injection in Production Browser Agents. Deploying AI agents that browse the web on behalf of users create...

Kyle Polley, Member of Technical Staff, Security Perplexity, speaks at [un]prompted 2026 on: Training BrowseSafe: Lessons from Detecting Prompt Injection in Production Browser Agents.

Deploying AI agents that browse the web on behalf of users creates a critical security challenge: how do we prevent malicious websites from hijacking agent behavior through embedded prompt injections? This presentation shares our experience training and deploying BrowseSafe, a defense system now protecting browser agents in production.
We'll cover the model training pipeline, including how we built BrowseSafe-Bench—a realistic benchmark with attacks embedded in high-entropy HTML pages that mirror actual web content. Our fine-tuned Mixture-of-Experts model (Qwen-30B) achieves F1 scores of ~0.91 while maintaining sub-100ms latency requirements for production deployment. The training process revealed key insights: attacks using linguistic camouflage, multilingual instructions, and visible text placement proved most challenging to detect, while traditional academic benchmarks significantly overestimate real-world detection accuracy.
More importantly, we'll discuss what we've observed in the wild since deployment. Real-world attack patterns, adversarial evolution, false positive challenges in diverse web content, and the data flywheel approach that continuously improves the model through production feedback all provide lessons for building robust security in agentic systems. This talk offers practical insights for security teams deploying AI agents that interact with untrusted web content at scale.