Topic · DiggingBeagle record
Perception-channel prompt injection
An attacker can place influence in DOM, accessibility, image or rendered canvas content and exploit differences in which layer an agent reads.
- Topic kind
- pattern
Definition & limits
A browser page is not one input stream. An agent may receive HTML, accessibility nodes, DOM text, screenshots or OCR-extracted pixels, and those representations do not contain identical content. A page can hold a concealed DOM instruction invisible to a human viewer or visually rendered text absent from a document parser. The security question is which version the agent actually consumed, and whether any observation was promoted from website content into tool authority.
In the AgentShield canvas experiment, researchers drew a faint product claim into low-opacity canvas pixels. Screenshot-first agents reproduced that claim in some configurations; DOM-only agents lacked the node entirely. A control rendered the whole visible article inside canvas, and DOM-only readers also missed that ordinary text. The result isolates a perception mismatch rather than proving all vision models can always be manipulated. The study's distinct stalled checkout experiment used a hidden instruction in an obstructed task. It requires different prerequisites and a different success metric.
A useful test matrix varies both source surface and consumer: readable DOM, hidden DOM, rendered canvas and screenshot OCR. Hold the underlying task constant, record the actual observation delivered to the model, then verify downstream side effects through the executor. Detecting a malicious instruction in one channel cannot certify another channel, and successfully quoting a product claim is not by itself a payment or data-theft event. Effect-bound approval still governs consequential actions irrespective of the perceptual path.
Examples
- AgentShield canvas claim was repeated by screenshot-first clients despite being absent from DOM.
- A hidden DOM instruction can affect text-parsing agents while leaving screenshot-only agents untouched.
- AgentShield rendered a manipulated statement as faint canvas pixels: it entered the screenshot path but not the DOM path, producing model-specific differences in a controlled test.