Perplexity launches BrowseSafe to protect AI agents

Perplexity has launched BrowseSafe, a model designed to detect malicious instructions inside web pages before an AI agent can read or act on them. The company is also publishing BrowseSafe-Bench, an open test set for measuring how well these defenses work.

The announcement, published on December 2, 2025, addresses a problem that emerges when AI stops merely answering questions and starts browsing the internet on your behalf. An agent can read entire pages, fill out forms, search for information, or carry out tasks. Everything it finds on the web must be treated as potentially dangerous.

The risk: instructions hidden in a page

The attack is known as prompt injection. It involves inserting text that tries to change the agent’s original instructions. For example, a page might include a message telling it to ignore the user’s request, reveal private information, or send data inside a URL.

The text does not have to be visible to a person. It can be hidden in:

• HTML code comments.
• Form fields and data attributes.
• Product descriptions, posts, or comments.
• Footers, table cells, or paragraphs that appear normal.

You may see nothing unusual. An agent, however, analyzes the page’s complete content and could interpret those instructions as part of the task.

A detector designed to work in real time

General-purpose AI models can analyze these threats, but running them on every page would be too slow and expensive. BrowseSafe specializes in one question: whether a page’s HTML contains malicious instructions directed at the agent.

The system scans content before it reaches the assistant’s main logic. According to Perplexity, its design allows it to review entire pages in real time without slowing down the browser. The model has open weights, so other developers can run it locally and integrate it into their own agents.

The tool is part of a multilayered strategy. Content from web pages, emails, or files is treated as untrusted and analyzed before it is used. Tool permissions are also restricted by default, and certain sensitive actions may require explicit confirmation from you.

What BrowseSafe-Bench measures

The evaluation set includes 14,719 examples based on pages with complex HTML, noisy content, and combinations of malicious and legitimate instructions. The cases vary across three factors: the attack’s objective, where it appears, and how it is written.

In total, it contains:

• 11 attack types.
• Nine insertion strategies, ranging from hidden fields to visible paragraphs and footers.
• Three linguistic styles, from direct commands to indirect or camouflaged text.

The tests show that explicit attacks, such as asking the agent to reveal the system prompt or extract information through a URL, are usually easier to detect. Multilingual, hypothetical, or indirect attacks are more difficult because they do not rely on obvious keywords.

Where the message is placed also matters. Comments are generally easier to detect, while instructions embedded in footers, tables, or visible paragraphs can go unnoticed more easily. Training with varied examples helps reduce that gap.

For you, this means an AI browser should not blindly trust any page it visits. BrowseSafe does not eliminate the risk, but it adds a specialized filter before the agent turns web text into actions. The next challenge will be testing how these defenses perform against new attacks, different languages, and pages designed specifically to fool detectors.