Benchmark Almanac

BrowseSafe++

BrowseSafe-Guard 94.8% tops its leaderboard GPT-6 Astra 91.5% leads the models we track
Not in model cards

Detectors judge 38,675 matched attack and control web pages built from real production prompt injections, in HTML, Markdown, accessibility-tree and screenshot views. Scored by F1.

24 attack types and 80 languages. The 9,175-pair test split is held for the board, which lists 17 text detectors and adaptive attacks on seven browser agents.

Made by
Perplexity
Released
October 2026
Kind
Jailbreaks and prompt injection
Level
University
Scored
Checked automatically
Answers
Multiple choice
Tasks
Public, plus a private test set
Strongest model tested
GPT-6 Astra #3 on the capability index
Last model added
September 2026
Scores refreshed
November 12th, 2026

In the authors’ words

Browser agents need to make decisions and execute actions on behalf of users while consuming untrusted webpages, creating opportunities for malicious instructions embedded in webpages to redirect legitimate tasks. We introduce BrowseSafe++, which extends BrowseSafe from 14,719 pages to 38,675 pairs of pages. Most of its prompt injections were observed in the wild on production websites. We keep each injection unchanged and rewrite the sensitive parts of the page around it to protect privacy. Each attacked page has a clean copy of the same page as its control. Both are provided as HTML, Markdown, an accessibility tree, and a screenshot. Every pair includes a user task and its expected answer. The benchmark includes twelve types of websites, from news articles to shared documents and forums, with 24 attack types appearing in 18 different locations on a page. We use these paired pages to train BrowseSafe-Guard, two 0.8B-parameter detectors for text and screenshots. Both achieve higher F1 scores than the detector based on frontier models, while keeping false-positive rates on benign pages and inference cost low. BrowseSafe-Adapt revises benchmark injections from browser-agent feedback, and attacks that succeed on only a few percent of tasks when replayed directly reach up to 95.41% success once adapted.

Abstract of BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views (arXiv:2610.17457, CC0)
17
Entries on its own leaderboard, 15 models we track

BrowseSafe-Guard tops the leaderboard with 94.8%

Best score per entry from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best. Every run is in the next chart. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders. The best model we track is GPT-6 Astra, at 91.5%.

The newest model with a score here came out in September 2026, and nobody has tested a newer one. Among the 20 highest-ranked models on the capability index, these have no score yet:

17 entries. Scroll sideways for the rest.

  1. 94.8 BrowseSafe-Guard
  2. 91.5 GPT-6 Astra
  3. 89.9 Gemini 3.1 Pro
  4. 89.3 GPT-5.5
  5. 89.0 Qwen3.7-Max
  6. 88.4 Jev 1.13
  7. 88.4 Claude Sonnet 5
  8. 86.5 Claude Fable 5.1
  9. 85.3 Claude Opus 5.5
  10. 80.9 Gemini 3.1 Flash-Lite
  11. 76.1 GPT-5.4 Nano
  12. 75.2 DeepSeek-V3.1
  13. 72.8 Claude Haiku 4.5
  14. 71.0 gpt-oss-20b
  15. 65.7 Qwen3-30B-A3B-Instruct
  16. 59.7 Mistral NeMo
  17. 23.1 Llama 3.1-8B
  1. 1 BrowseSafe-Guard 94.8%
  2. 2 GPT-6 Astra 91.5%
  3. 3 Gemini 3.1 Pro 89.9%
  4. 4 GPT-5.5 89.3%
  5. 5 Qwen3.7-Max 89%
  6. 6 Jev 1.13 88.4%
  7. 7 Claude Sonnet 5 88.4%
  8. 8 Claude Fable 5.1 86.5%
  9. 9 Claude Opus 5.5 85.3%
  10. 10 Gemini 3.1 Flash-Lite 80.9%
  11. 11 GPT-5.4 Nano 76.1%
  12. 12 DeepSeek-V3.1 75.2%
  13. 13 Claude Haiku 4.5 72.8%
  14. 14 gpt-oss-20b 71%
  15. 15 Qwen3-30B-A3B-Instruct Jul 2025 65.7%
  16. 16 Mistral NeMo 59.7%
  17. 17 Llama 3.1-8B 23.1%

Source: Official BrowseSafe++ leaderboard

#EntryScoreSettingDateSource
1 BrowseSafe-Guard 94.8% Official leaderboard
2 GPT-6 Astra 91.5% Sep 2026 Official leaderboard
3 Gemini 3.1 Pro 89.9% Feb 2026 Official leaderboard
4 GPT-5.5 89.3% Apr 2026 Official leaderboard
5 Qwen3.7-Max 89% May 2026 Official leaderboard
6 Jev 1.13 88.4% Official leaderboard
7 Claude Sonnet 5 88.4% Jun 2026 Official leaderboard
8 Claude Fable 5.1 86.5% Sep 2026 Official leaderboard
9 Claude Opus 5.5 85.3% Sep 2026 Official leaderboard
10 Gemini 3.1 Flash-Lite 80.9% Mar 2026 Official leaderboard
11 GPT-5.4 Nano 76.1% Mar 2026 Official leaderboard
12 DeepSeek-V3.1 75.2% Aug 2025 Official leaderboard
13 Claude Haiku 4.5 72.8% Oct 2025 Official leaderboard
14 gpt-oss-20b 71% Aug 2025 Official leaderboard
15 Qwen3-30B-A3B-Instruct Jul 2025 65.7% Jul 2025 Official leaderboard
16 Mistral NeMo 59.7% Jul 2024 Official leaderboard
17 Llama 3.1-8B 23.1% Jul 2024 Official leaderboard

Accuracy and latency

Mean text-view accuracy against the median seconds per page for one detection call, on a log scale. The line joins the runs that no other run beats on both measures. We redrew this chart from the numbers on the official leaderboard.

60% 80% 100% 0.1110100 Latency per page (s), log scale, lower is better Accuracy Mistral NeMo: Accuracy 56.3%, latency per page 3.69 s Llama 3.1-8B: Accuracy 54.7%, latency per page 1.38 s Qwen3-30B-A3B-Instruct: Accuracy 62.3%, latency per page 8.21 s gpt-oss-20b: Accuracy 71.5%, latency per page 3.81 s DeepSeek-V3.1: Accuracy 77.6%, latency per page 12.5 s Claude Haiku 4.5: Accuracy 63.9%, latency per page 4.45 s Gemini 3.1 Pro: Accuracy 89%, latency per page 7.65 s Gemini 3.1 Flash-Lite: Accuracy 78.3%, latency per page 1.35 s GPT-5.4 Nano: Accuracy 73.4%, latency per page 1.39 s GPT-5.5: Accuracy 88.4%, latency per page 2.5 s Qwen3.7-Max: Accuracy 88.4%, latency per page 13.4 s Claude Sonnet 5: Accuracy 87%, latency per page 4.6 s Claude Fable 5.1: Accuracy 85.4%, latency per page 9.64 s GPT-6 Astra: Accuracy 91%, latency per page 3.36 s Claude Opus 5.5: Accuracy 87.1%, latency per page 5.08 s Jev 1.13: Accuracy 88.3%, latency per page 0.95 s. Not in our model list BrowseSafe-Guard: Accuracy 94.9%, latency per page 0.15 s. Not in our model list BrowseSafe-Guard 60% 80% 100% 0.1110100 Latency per page (s), log scale, lower is better Accuracy Mistral NeMo: Accuracy 56.3%, latency per page 3.69 s Llama 3.1-8B: Accuracy 54.7%, latency per page 1.38 s Qwen3-30B-A3B-Instruct: Accuracy 62.3%, latency per page 8.21 s gpt-oss-20b: Accuracy 71.5%, latency per page 3.81 s DeepSeek-V3.1: Accuracy 77.6%, latency per page 12.5 s Claude Haiku 4.5: Accuracy 63.9%, latency per page 4.45 s Gemini 3.1 Pro: Accuracy 89%, latency per page 7.65 s Gemini 3.1 Flash-Lite: Accuracy 78.3%, latency per page 1.35 s GPT-5.4 Nano: Accuracy 73.4%, latency per page 1.39 s GPT-5.5: Accuracy 88.4%, latency per page 2.5 s Qwen3.7-Max: Accuracy 88.4%, latency per page 13.4 s Claude Sonnet 5: Accuracy 87%, latency per page 4.6 s Claude Fable 5.1: Accuracy 85.4%, latency per page 9.64 s GPT-6 Astra: Accuracy 91%, latency per page 3.36 s Claude Opus 5.5: Accuracy 87.1%, latency per page 5.08 s Jev 1.13: Accuracy 88.3%, latency per page 0.95 s. Not in our model list BrowseSafe-Guard: Accuracy 94.9%, latency per page 0.15 s. Not in our model list BrowseSafe-Guard
ModelSettingAccuracyLatency per page
BrowseSafe-Guard 94.9% 0.15 s
GPT-6 Astra 91% 3.36 s
Gemini 3.1 Pro 89% 7.65 s
Qwen3.7-Max 88.4% 13.4 s
GPT-5.5 88.4% 2.5 s
Jev 1.13 88.3% 0.95 s
Claude Opus 5.5 87.1% 5.08 s
Claude Sonnet 5 87% 4.6 s
Claude Fable 5.1 85.4% 9.64 s
Gemini 3.1 Flash-Lite 78.3% 1.35 s
DeepSeek-V3.1 77.6% 12.51 s
GPT-5.4 Nano 73.4% 1.39 s
gpt-oss-20b 71.5% 3.81 s
Claude Haiku 4.5 63.9% 4.45 s
Qwen3-30B-A3B-Instruct Jul 2025 62.3% 8.21 s
Mistral NeMo 56.3% 3.69 s
Llama 3.1-8B 54.7% 1.38 s

The best score, 91.5%, costs $0.11 a task

Runs on the cost frontier score higher than any run that's cheaper. Qwen3.7-Max comes within 2.5 points of the best for $0.02 a task, 6 times cheaper. The costs are the leaderboard's own estimates, so compare them only within this benchmark.

OpenAI Google DeepMind Qwen Cost frontier One model at each effort level
0% 20% 40% 60% 80% 100% $0.0001 $0.001 $0.01 $0.10 $1.00 Cost per task, log scale GPT-6 Astra Gemini 3.1 Pro Gemini 3.1 Flash-Lite GPT-5.4 Nano gpt-oss-20b 0% 20% 40% 60% 80% 100% $0.0001 $0.001 $0.01 $0.10 $1.00 Cost per task, log scale GPT-6 Astra Gemini 3.1 Flash-Lite

Source: Official BrowseSafe++ leaderboard

ModelEffortHarnessScoreCost per taskOutput tokens
GPT-6 Astra 91.5% $0.11 79
Gemini 3.1 Pro 89.9% $0.03 73
GPT-5.5 89.3% $0.06 87
Qwen3.7-Max 89% $0.02 250
Claude Sonnet 5 88.4% $0.04 284
Claude Fable 5.1 86.5% $0.18 433
Claude Opus 5.5 85.3% $0.07 241
Gemini 3.1 Flash-Lite 80.9% $0.003 93
GPT-5.4 Nano 76.1% $0.002 73
DeepSeek-V3.1 75.2% $0.003 465
Claude Haiku 4.5 72.8% $0.01 284
gpt-oss-20b 71% $0.0002 38
Qwen3-30B-A3B-Instruct Jul 2025 65.7% $0.0006 172
Mistral NeMo 59.7% $0.0002 70
Llama 3.1-8B 23.1% $0.0006 57

Number one over time

Lab claims count from the day the card came out, independent runs from the model’s release.

OpenAI
Own leaderboard Passed 85% in Oct 2026, by GPT-6 Astra
GPT-6 Astra 91.5%

Source: Official BrowseSafe++ leaderboard

Gemini 3.1 Pro on the official leaderboard passed 85% in February 2026

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard Best so far
0% 20% 40% 60% 80% 100% 2025 2026 Near the ceiling (85%) GPT-6 Astra Gemini 3.1 Pro DeepSeek-V3.1 gpt-oss-20b Qwen3-30B-A3B-Instruct Mistral NeMo 0% 20% 40% 60% 80% 100% 2025 2026 Near the ceiling (85%) GPT-6 Astra DeepSeek-V3.1

Source: Official BrowseSafe++ leaderboard

No lab model card reports it yet

We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark.

Versions

We switch the top row to each new version when it comes out. Open it for one row per version. An old version stays in play while people still test it, so whoever first takes it past 85% gets credit for closing it out.

Anthropic OpenAI
BrowseSafe++ Passed 85% in Oct 2026, by GPT-6 Astra
GPT-6 Astra 91.5%
BrowseSafe-Bench Passed 85% in Nov 2025, by Claude Sonnet 4.5
Claude Sonnet 4.5 86.3%
BrowseSafe++ Passed 85% in Oct 2026, by GPT-6 Astra
GPT-6 Astra 91.5%

Source: Official leaderboards

Replaces BrowseSafe-Bench

More in Safety and alignment

All 465 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. Gemini 4 Carbon 0%
  • DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics. Muse Spark 1.2 88.4%
  • Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
  • IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%