InSTA: Towards Internet-Scale Training For Agents

1 Introduction

• Human demonstrations on manually curated sites are laborious to collect, costly to scale, cover only a small share of the internet, and remain static.InSTA aims to reduce dependence on human annotations through an automatic pipeline for internet-scale agent training.Source: §1 · p. 1
• The task proposer annotates 150k sites with live tasks, filters for safe content with 97% accuracy, and uses agent progress and judge evaluations to propose harder tasks.This feedback loop grounds new tasks in the latest website content.Source: §1 · p. 1
• The pipeline uses LLM agents to produce trajectories and a judge to select successful data, yielding a dataset with 2.2M screenshots, 2.2M action traces, and 150k judge traces.The authors release the dataset and pipeline.Source: §1 · p. 2
• The top agent based on Qwen 3 1.7B achieves a 56.9% success rate, outperforming Qwen 3 235B, beating a 235 times larger Llama 4 Maverick, and reaching 94.7% of Gemini 2.5 Flash’s performance.Source: §1 · p. 2

Language Model Agents

• Language-model agents use language models as agent backbones, while explicit search algorithms can provide a scaffold and test-time compute for reasoning.Fine-tuning agents is increasingly studied as target benchmarks become harder to solve zero-shot.Source: §2 · p. 2

Agent Pipelines

• Prior agent pipelines often train on data overlapping their test environments; InSTA instead separates both tasks and website configurations between training and testing.The authors report training small models that match frontier LLMs on Web Voyager without Web Voyager training data.Source: §2 · pp. 2–3

Agent Datasets

• Web-agent datasets commonly rely on human-created tasks or demonstrations, cover only a small fraction of internet sites, and are static; InSTA targets a dynamic internet-scale environment.The authors distinguish their work from earlier environment and synthetic-data efforts rather than claiming to be first in either area.Source: §2 · p. 3

Language Model Judges

• LLM judges are used across response evaluation, reasoning verification, rejection sampling, search, harmful-response filtering, feedback, and alignment rating.InSTA’s verifier produces a reasoning trace and a 0-to-1 trajectory score to rank data for selection.Source: §2 · p. 3

3 Language Model Agents

• The agent’s policy predicts textual actions from browser observations and the task, with the LLM generating actions through next-token prediction conditioned on a system prompt.The paper prompts for reasoning traces containing function-call actions and parses the first JSON code block, allowing a second response if parsing fails.Source: §3 · pp. 3–4
• Browser observations are converted into multimodal prompts, and generated language-model responses are parsed into actions.For web navigation, the environment state is HTML DOM; the paper describes a compact Markdown representation among common formats.Source: §3 · p. 3
• Agents operate through Playwright function calls, using function names and named argument-value pairs to interact with the browser until they complete a task and stop.The task is a natural-language instruction, and the agent begins at an initial URL.Source: §3 · pp. 3–4

4 Internet-Scale Task Generation

• The pipeline is designed to broaden real-world site coverage while avoiding reliance on human annotations and grounding tasks in exploration of each environment.The authors identify these as two desiderata for task generation.Source: §4 · p. 4

4.1 Language Model Task Proposer

• The task proposer uses an initial easy task and an exploratory agent trajectory to generate a harder, grounded task; this paper runs one generation loop.Scaling the process annotated 150k sites, with tasks released as the insta-150k-v2 dataset.Source: §4.1 · pp. 4–5

4.2 Safety & Reliability

• Up to 97% of websites were correctly classified by the safety filter, with recall for unsafe websites as high as 1.0.The evaluation used 100 websites, half containing harmful or mature content.Source: §4.2 · p. 5, Table 1 · p. 5
• Up to 89% of tasks produced in the initial phase were achievable and verifiable by human workers.The assessment covered tasks from 100 websites.Source: §4.2 · p. 5, Table 2 · p. 5

4.3 Scaling To 150,000 Websites

• Common Crawl’s top 1M sites by PageRank were filtered to 150k safe sites with tasks, using two 8-GPU V100 machines for 14 hours per generation phase.The paper reports statistics for the tasks in Figure 3.Source: §4.3 · p. 6

5 Internet-Scale Environment

• Daily changes to website content can invalidate fixed ground-truth solutions, so the paper motivates judging agent solutions in the latest web context.The authors frame this as a requirement for moving beyond a static dataset toward a dynamic internet-scale environment.Source: §5 · p. 6

5.1 Evaluation With Language Models

• The judge estimates task success from the task and agent trajectory, producing a reasoning trace with a 0-to-1 score that is parsed from its response.The score is extracted as rT from the language model output.Source: §5.1 · p. 6
• GPT-4o reached 82.6% accuracy detecting successful trajectories, and trajectories with confidence 1 were classified with accuracy up to 93.1%.Accuracy remained stable as PageRank fell across the tested language models.Source: §5.1 · p. 6, Figure 5 · p. 7

5.2 Scaling To 150,000 Agents

• A large collection run on 150k websites produced 2.2M screenshots, 2.2M action reasoning traces, and 150k judge reasoning traces.The run used a fine-tuned Qwen3 1.7B agent and a zero-shot Qwen3 235B judge, and required 1,200 V100 GPU hours at a reported cost of $521.55.Source: §5.2 · p. 7, Figure 6 · p. 7

6 Training Agents

• The experiments test data scale, transfer to new domains, and scaling with additional test-time compute.The study trains agents on trajectories produced by the internet-scale data flywheel and evaluates them on popular benchmarks.Source: §6 · p. 7

6.1 Performance Improves With Data Scale

• The Qwen 3 1.7B top checkpoint outperforms the Qwen 3 235B data collection policy and beats Llama 4 Maverick, which is 235 times larger.The reported comparisons are on a test set of 3,000 held-out websites and tasks.Source: Figure 7 · p. 7, §6.1 · p. 8
• Performance improves with increasing data scale, with gains scaling faster on trajectories filtered by the judge.The filter selects trajectories where Judge(Success) = 1.Source: §6.1 · p. 8

6.2 Agents Transfer To New Domains

• With no benchmark-specific training data, Qwen 3 1.7B checkpoints match strong LLMs on WebVoyager for three of four judges.The figure reports that trends from the authors’ test set also hold on WebVoyager.Source: Figure 8 · p. 8, §6.2 · p. 8
• +149.0% for WebLINX and +156.3% for Mind2Web; adding InSTA data improves generalization to the authors’ harder test set while preserving performance on the original test sets.The comparison mixes 80% human data with 20% InSTA data.Source: Figure 9 · p. 8, §6.2 · p. 8

6.3 Performance Scales With Test-time Compute

• 70% success for Gemini 2.5 Flash with 500 reasoning tokens, up from 60% with 50 tokens.Success rate improves monotonically as the reasoning budget increases.Source: Figure 10 · p. 9, §6.3 · p. 9

7 Conclusion

• The pipeline uses pretrained language models as a task proposer, agent, and judge to curate high-quality training data without human intervention.It annotates 150k diverse sites with agentic tasks.Source: §7 · p. 9
• 56.9% success on the test environment for the Qwen 3 1.7B top checkpoint, which outperforms Qwen 3 235B, beats a 235-times-larger Llama 4 Maverick, and reaches 94.7% of Gemini 2.5 Flash’s performance.The authors also report zero-shot transfer to WebVoyager and scaling with test-time compute.Source: §7 · p. 9

7.1 Future Work

• Future work could scale the pipeline to more sites, optimize judge scores through reinforcement learning, and extend task generation to multimodal tasks.The authors note that the latest Common Crawl release contains data for more than 300M sites.Source: §7.1 · p. 9

A Limitations & Safeguards

• The pipeline generates one task per site and caps agents at 30 actions, while avoiding tasks involving personal data or user accounts.The authors report an average of 90 seconds of interaction per site and no additional web traffic from offline training.Source: A Limitations & Safeguards · p. 14
• The task proposer filters harmful-content, user-inaccessible, and account-dependent sites; its safety filter reaches up to 97% accuracy, with 0.98–1.0 recall for unsuitable sites.Account-dependent examples include social media and forum sites.Source: A Limitations & Safeguards · p. 14
• The pipeline can use scrubadub to remove PII, an option the authors recommend enabling.The option toggles PII removal across website data.Source: A Limitations & Safeguards · p. 14

B Ethical Considerations

• The authors prohibit copying books, documents, videos, audio, or files and convert public HTML DOM information into a sparse Markdown summary focused on interactive elements.They describe the transformation as significantly changing the webpage in a non-reversible manner.Source: B Ethical Considerations · p. 14
• These safeguards reduce but do not eliminate the risk that private or sensitive material is shown to an agent.The authors identify detection, replacement, and removal of such material from text and images as an ongoing safety task.Source: B Ethical Considerations · p. 14

C Broader Impacts

• Browser agents can provide convenience for personal tasks while also creating an attack vector for unintended actions; some risks may require policy changes.The paper also notes potential worker displacement from agents that automate work tasks.Source: C Broader Impacts · p. 14

D Agents.txt & Standards For Internet Agents

• The paper proposes an Agents.txt-style standard for website controls, including interaction limits, page and data-access restrictions, and virtual playgrounds for agent training.Playgrounds would use simulated data and direct agent traffic away from user-facing pages.Source: D Agents.txt & Standards For Internet… · p. 15

E More Details On Task Generation

• The first-phase prompt makes tasks passive and non-modifying; LLMs receive 16 randomly sampled examples from 100 hand-picked URL-task pairs to diversify exploration.The prompt was used with Llama 3.1 70B, GPT-4o, and Gemini 1.5 Pro.Source: E More Details On Task Generation · pp. 15–16
• A second-phase proposer uses prior agent runs to create harder, website-grounded tasks, with suggested intermediate steps and success criteria.Its task schema also excludes account creation, login, personal-information submission, purchases, and orders.Source: E More Details On Task Generation · pp. 19–20

E.1 Details For Safety Experiment

• The safety-filter experiment evaluates 100 manually labeled sites—50 safe and 50 unsafe—using “N/A” task-proposer outputs as positive unsafe labels, and measures accuracy, precision, and recall.The sites span popular websites and less popular sites that may be underrepresented in LLM training data; the experiment uses the main-experiment prompts.Source: §E.1 · pp. 21–22

E.2 Details For Reliability Experiments

• For 100 randomly sampled websites marked safe by the task proposer, researchers attempted each generated task and checked whether the site contained enough information to verify a solution.They annotated 300 tasks for Table 2 in 6 hours.Source: §E.2 · p. 22

• Llama 3.1 70B automatically labels dataset task categories.Source: Figure 12 · p. 23
• The prompt limits category labels to three words or fewer.Source: Figure 12 · p. 23
• Sampling temperature is set to 0.5 to encourage more consistent category wording.Source: Figure 12 · p. 23
• The categories are used to examine agent performance by category.Source: Figure 12 · p. 23

F Understanding Agent Capabilities & Limitations

• 22 of the top 70 task categories with at least 100 assigned tasks have average success probability above 0.5 for zero-shot Llama 3.1 70B agents.Strong categories include finding contact information, operating hours, and biographical information, as well as weather forecasts and health research.Source: Figure 14 · p. 24, F Understanding Agent Capabilities &… · p. 24
• 5% is the lowest success rate among the bottom 70 categories, where many tasks require remembering and reasoning over prior interactions or actions unavailable through Playwright.Product comparison may benefit from a note-taking tool; downloading reports or opening files may require a fully operable virtual computer environment.Source: F Understanding Agent Capabilities &… · p. 24, Figure 15 · p. 25

G Agent & Judge System Prompts

• The agent prompt is designed to elicit reasoning, and the judge scores success, efficiency, and self-correction, but training data is filtered only by success.The judge’s success score estimates the probability that the task was completed; efficiency and self-correction scores assess path efficiency and behaviors such as backtracking, replanning, and recognizing mistakes.Source: G Agent & Judge System Prompts · pp. 24, 29
• The agent interface supports filling inputs, selecting options, setting checkbox states, navigating back or to a URL, and stopping with a progress report.Actions target identified page elements where applicable; navigation and stop actions use no target element.Source: G Agent & Judge System Prompts · pp. 30–32
• For a range slider, the script translates a requested value into the slider’s underlying value before filling it.In the example, a desired $1000 maps to underlying value 20 on a slider ranging from 0 to 50 with step 1.Source: G Agent & Judge System Prompts · p. 31
• The judge scores confidence in successful completion, path efficiency, and self-correction, including backtracking, replanning, and recognizing mistakes.It is instructed to analyze explicit completion criteria and identify which criteria the script satisfied.Source: G Agent & Judge System Prompts · p. 33

H Details For Training Agents

• Agents are tested on InSTA, WebVoyager, Mind2Web, and WebLINX, with held-out websites excluded from training data.The InSTA test set contains 3,000 websites and tasks; WebVoyager evaluation transfers agents zero-shot to 643 tasks across 15 websites.Source: H Details For Training Agents · p. 33
• Filtering keeps trajectories judged successful: 10.5k of 20k Qwen 3 235B trajectories passed the success-score filter.The judge also predicts efficiency and self-correction scores, but the study did not use them for filtering.Source: H Details For Training Agents · p. 33
• Mind2Web and WebLINX use their official test splits and prior-work hyperparameters, with InSTA websites excluded from their training data.Source: H Details For Training Agents · p. 34

I Hyperparameters

• For static benchmarks, filtered InSTA trajectories are sampled at 20% versus 80% for human data, using all available human data.Source: I Hyperparameters · p. 34

J Cost Analysis For Llama 3.1 70B

• Up to 95% cost reduction is reported with local models.The authors identify Llama 3.1 70B as a feasible option for running agents at this scale.Source: J Cost Analysis For Llama 3.1 70B · p. 34, Table 4 · p. 36
• The authors report that using Llama 3.1 70B locally is feasible at scale and does not compromise performance.They state this choice of LLM backbone does not compromise performance.Source: J Cost Analysis For Llama 3.1 70B · p. 34
• Table 4 analyzes token counts processed by different LLMs and the expected cost of proprietary-model serving, highlighting local vLLM's role in reducing costs.The analysis computes expected costs as if token processing were served using proprietary models.Source: J Cost Analysis For Llama 3.1 70B · p. 34, Table 4 · p. 36