Your agent reads.
Attackers write.
We stop them.

We don't parse HTML. We spin up a real browser, execute all JavaScript, apply all CSS, expand all iframes, and capture the final computed DOM state. This is the only way to catch dynamically injected payloads that don't exist in the source HTML.

Every DOM element is scored across six independent axes: opacity, z-index layering, contrast ratio, viewport clipping, text visibility, and stack order. An element must pass all six to be considered visible. Hidden elements fail this check regardless of technique.

We screenshot the rendered page and run OCR to extract every text element. We cross-reference OCR output against the DOM tree. Text in the DOM but absent from the visual snapshot is a threat signal. Attackers cannot make text both invisible to humans and readable to agents simultaneously.

Anything flagged by physics or vision is passed to an LLM for semantic review. Does this text read like an instruction for an AI agent? Does it attempt to override context, exfiltrate data, or alter behavior? This stage catches sophisticated social engineering that purely structural checks miss.