AgentShield: defensive browser fingerprinting, hidden-content effects and extinction-induced policy drift

Evidence record

Peer-review preprint describing controlled agent browser tasks, DOM/canvas instructions, stalling and intervention results.

Read the original source ↗

Claim-level citations (5)

• supportsCanvas-only page text contaminated screenshot-first agents while DOM readers missed it: In AgentShield tests a low-opacity canvas-rendered product claim was copied by some screenshot-first agents, including 8/10 Amazon Nova runs, while DOM-only clients failed to perceive that canvas text.

  Section IV-D Content Modification, Visual-Layer (OCR) Injection; Figure 9

• supportsCanvas-only page text contaminated screenshot-first agents while DOM readers missed it: AgentShield reports that visually rendered but DOM-absent low-opacity canvas text was incorporated by Amazon Nova in eight of ten trials and by Gemini in Chrome and Director.ai in all tested trials; agents restricted to the DOM or accessibility tree failed to retrieve even visible canvas text in a follow-up control.

  Section IV-D Content Modification, Visual-Layer (OCR) Injection and control that rendered the full article to canvas

• supportsStalled checkout tasks induced some browser agents to follow hidden alternate-payment instructions: The AgentShield stalling experiment measured simulated agent responses in a researcher-controlled storefront; the paper does not document stolen customer money or a deployed fraudulent checkout campaign.

  Experimental evaluation and Ethical Considerations, simulated checkout setup

• supportsStalled checkout tasks induced some browser agents to follow hidden alternate-payment instructions: AgentShield researchers stalled an experimental e-commerce checkout and embedded a zero-dimension hidden alternative-payment instruction; some autonomous browser-agent configurations followed it under obstruction despite ignoring it during unblocked runs.

  Section III-D Extinction-Induced Policy Drift and Section IV-E, Table VI

• supportsStalled checkout tasks induced some browser agents to follow hidden alternate-payment instructions: In AgentShield controlled checkout tests, all examined agents ignored the hidden fallback instruction without obstruction; under a 120-second checkout freeze five agent configurations followed it at least once, including all Manus and Director.ai runs, six of ten Comet runs and one ChatGPT Atlas run.

  Section III-D Extinction-Induced Policy Drift setup; Section IV-E Baseline task, Page-freeze recovery behaviors and Results