LoRA adapters (r=16, alpha=32) over TIGER-Lab/BrowserAgent-RFT (Qwen2.5-7B) from a 6-iteration adversarial co-evolution loop on multi-turn web form-filling tasks. An ADVERSARY learns to prompt-inject a frozen world model to derail a web EXECUTOR; both update each iteration (reactive attack: injection lands on the page the executor's action produces).

Load: PeftModel.from_pretrained(base, "GussailRaat/browseragent-adversary-coevo", subfolder="exec_v5").

Under the strongest adversary adv_v6 (3 seeds): clean capability rises across iters (0.70 -> 0.95, peak exec_v5), but adv_v6 floors every executor to ~0.15-0.22 under attack — co-evolution converged to a dominant adversary. Best executor = exec_v5 (0.950 clean / 0.217 attacked). Under the weaker adv_v3, exec_v2 held 0.516 attacked.