We present WebGym, the largest-to-date open-source environment for training realistic visual web agents. Real websites are non-stationary and diverse, making artificial or small-scale task sets insufficient for robust policy learning. WebGym contains nearly 300,000 tasks with rubric-based evaluations across diverse, real-world websites and difficulty levels. We train agents with a simple reinforcement learning (RL) recipe, which trains on the agent's own interaction traces (rollouts), using task rewards as feedback to guide learning. To enable scaling RL, we speed up sampling of trajectories in WebGym by developing a high-throughput asynchronous rollout system, designed specifically for web agents. Our system achieves a 4-5x rollout speedup compared to naive implementations. Second, we scale the task set breadth, depth, and size, which results in continued performance improvement. Fine-tuning a strong base vision-language model, Qwen-3-VL-8B-Instruct, on WebGym results in an improvement in success rate on an out-of-distribution test set from 26.2% to 42.9%, significantly outperforming agents based on proprietary models such as GPT-4o and GPT-5-Thinking that achieve 27.1% and 29.8%, respectively. This improvement is substantial because our test set consists only of tasks on websites never seen during training, unlike many other prior works on training visual web agents.
Environmental Injection Attacks against GUI Agents in Realistic Dynamic Environments
College of AI, Tsinghua University（清华大学人工智能学院）；Department of Computer Science and Technology, Tsinghua University（清华大学计算机科学与技术系）；School of Computer Science, Peking University（北京大学计算机学院）
Beyond a Single Perspective: Towards a Realistic Evaluation of Website Fingerprinting Attacks
Institute for Network Sciences and Cyberspace, Tsinghua University（网络科学与网络空间研究院，清华大学）；School of Cyber Science and Engineering, Southeast University（网络安全科学与工程学院，东南大学）；National Key Laboratory of Information Systems Engineering, National University of Defense Technology（信息系统工程国家重点实验室，国防科技大学）；Department of Computer Science, Tsinghua University（计算机科学系，清华大学）
EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
The Ohio State University（俄亥俄州立大学）；University of Chicago（芝加哥大学）；University of Wisconsin, Madison（威斯康星大学麦迪逊分校）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；University of California, Los Angeles（加利福尼亚大学洛杉矶分校）
WebOperator: Action-Aware Tree Search for Autonomous Agents in Web Environment
Department of Computer Science and Engineering（计算机科学与工程系）；Bangladesh University of Engineering and Technology (BUET)（孟加拉工程与技术大学）；Faculty of Information Technology（信息技术学院）；Monash University（莫纳什大学）；Qatar Computing Research Institute (QCRI)（卡塔尔计算研究所）
Learning Simple Test-Time Environments for LLM Web Agents
College of Computer Science and Technology, Jilin University（吉林大学计算机科学与技术学院）；Dept. of Comp. Sci. & Tech., Tsinghua University（清华大学计算机科学与技术系）；School of Electronic and Information Engineering, Beijing Jiaotong University（北京交通大学电子信息工程学院）；Institute for AI Industry Research (AIR), Tsinghua University（清华大学人工智能产业研究院）；Tongyi Lab, Alibaba Group（阿里巴巴集团通义实验室）
