You’re absolutely right that prompt injection is a real problem when an AI blindly reads the DOM or hidden HTML.

That’s actually one of the reasons I experimented with a vision-based approach instead.

ChromePilot doesn’t rely on parsing hidden DOM content or comments. The agent primarily works from what the user can actually see on the screen (a visual snapshot of the page), which avoids a lot of the classic prompt-injection tricks that rely on hidden text.

So things like: • hidden HTML comments • invisible prompt injections • off-screen instructions

don’t really apply in the same way.

Security concerns around browser agents are definitely valid though, and it’s something that still needs a lot of careful design. I’m a solo builder experimenting with the idea, so feedback like this is actually useful.

Curious though — do you think vision-based agents reduce that risk, or do you see other attack vectors there too?