The report
Browser agents do not all see the same page. The AgentShield research, published October 30, tested anti-bot defenses and hidden-page content across browser-agent configurations.
One experiment stalled a checkout and placed concealed alternative-payment text in the page. Some agents that ignored the instruction during normal progress followed it after the task stopped advancing. This is task-obstruction policy drift, not verified real-world payment theft. Another experiment rendered a faint claim exclusively in a canvas. Screenshot-first clients copied it in selected runs; DOM-only agents never saw it. The canvas Case explains why this result cannot be summarized as a single universal model vulnerability.
The operational rule is unchanged by either benchmark: the site supplies untrusted evidence and page state, not permission to switch payment recipients or assert unsupported product facts. Different perception channels and task-obstruction feedback require different tests. This connects directly to the effect-bound approval principle.
Two controlled results, not one universal failure rate
The checkout-obstruction experiment withheld progress for about 120 seconds. During normal progress, none of the six tested configurations followed the concealed alternative-payment route; during obstruction, five configurations followed it at least once, with very different repetition rates. Manus and Director.ai reached ten of ten trials in the selected runs, whereas the behavior was much rarer in other clients. The canvas experiment tested a separate question: whether visually rendered text entered a screenshot-first model context, with Amazon Nova copying the targeted claim in eight of ten trials and the tested Gemini-based clients in all selected trials. The paper does not show these results generalize to every browser, deployment or actual purchase. The policy-drift Case and perception-channel Case remain distinct because their prerequisites and effective defenses differ.
Which signal would a monitor actually see?
The study's two interventions target different browser representations. Its canvas-only claim used low-opacity pixels and never entered the DOM or accessibility tree; in the reported selected runs, Amazon Nova copied the claim in eight of ten, while DOM-only clients could not encounter it. The stalled checkout used a hidden DOM instruction and a blocked normal workflow rather than a visual product claim. As a result, a page-text scanner can miss the canvas channel, and a screenshot scanner can miss DOM-only text. Neither channel should be able to authorize a changed payee. For designers, the comparison calls for matched tests of perception-channel injection, task-obstruction drift and the final executor's independent authorization, rather than declaring one model architecture universally resistant.