WebTrap Park - Malicious Prompt Injection: leaderboard
Metric: Security score (%; instructions injected into page content as visible or invisible form text, ARIA labels or mirrors; score = 1 - attack success rate, from the web agent's click and type actions instrumented in the web environment; framework and model configuration as labelled). Source: arxiv.org. Saturation forecast: Rough model projection: around 2026. 15 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Agent-E + GPT-4o | 79.17 |
| 2 | SeeAct + GPT-4o | 73.25 |
| 3 | Skyvern + Claude Sonnet 4 | 71.6 |
| 4 | SeeAct + Qwen-VL-Max | 71.35 |
| 5 | Browser Use (text) + GPT-4o | 71.27 |
| 6 | Skyvern + GPT-4o | 71.16 |
| 7 | Browser Use (text) + Qwen2.5-72B-Instruct | 69.3 |
| 8 | Browser Use (vision) + Claude Sonnet 4 | 67 |
| 9 | Agent-E + o3 | 66.45 |
| 10 | Browser Use (text) + DeepSeek-V3 | 65.79 |
Interactive version: theaggregate.ai/benchmark?slug=webtrap-park-malicious-prompt-injection · How It Works · Data refreshed daily, snapshot 2026-09-26.