Constructing Challenging Browser-Use Tasks by Controlled Environment Interventions

As browser-use agents improve, benchmarks keep pace by adding new tasks, websites, and applications. Doing so is costly, and because many factors change at once, it is unclear what makes the new tasks harder. In this work, we instead make existing tasks harder by changing the environment in which they are performed, so that difficulty becomes a programmable property of the environment. We introduce BreakingWeb, in which each task is run twice: once on an unmodified website and once under an intervention, a controlled change to the website's content, server state, network responses, or rendered page. Each intervention is reproducible, keeps the user instruction and success criterion fixed, can be detected and worked around by a competent user, and is labeled with the behavior that recovery from it mainly requires, such as verification. BreakingWeb contains $519$ task pairs on seven self-hosted websites, and each run is scored on the website's final backend state. We evaluate six strong browser-use agents, three agents that observe only screenshots, and human participants. Interventions lower the pass rates of the six browser-use agents by $22.9$ percentage points on average, and each agent fails on nearly half of the tasks it solves on the unmodified website. Humans are affected much less: their pass rate drops by $10.0$ points on the first attempt and by $5.7$ points when they repeat the task. Most failures of the six agents ($75\%$) are \emph{belief failures}, in which the agent declares the run finished although a required change was never made. Our code, data, and environments are available at https://www.breakingweb.app.