A new test set has 38,675 page pairs for prompt injection

Attacks that the authors change with feedback from a browser agent have a maximum success rate of 95.41%.