Web Agents Learn to Fight Prompt Injection

🔥 What happened Sarim Hashmi's team dropped AdvSim2Real: a 4B web agent trained inside a simulated web world against an adaptive prompt-injection adversary. Task curriculum, attacker, and agent co-evolve together. 💡 Why it matters Old defenses break the moment attackers adapt. AdvSim2Real lifts task completion against an unseen frontier-model adversary by 33.6% relative to the base agent — and the capability gain transfers to a real browser. ⚡ Our take Finally someone treats prompt injection as an arms race instead of a static fine-tuning checkbox. Shipping web agents without adversarial co-training is shipping a known vulnerability on purpose.