HTML is the new Markdown. Your agent reads a different page

Interesting finding that 10 of 16 HTML-to-text tools ignore CSS entirely — a good reminder that 'extracted text' and 'visible text' were never the same thing. The headless-Chromium render comparison is a clever detection approach; it sidesteps the arms race of parsing every new hiding trick. Would be interesting to see the same test run against Markdown renderers.

The two-readers framing is the part people underrate. I ran into a small version of this from the other direction: I built a local tool that explains official letters, and the design rule ended up being that the model only ever sees the fields the code extracted, never a number it could invent. Your tests are the same gap in reverse - what the agent "read" is whatever the converter decided to keep. Did any of the converters you tried handle display:none differently from aria-hidden? That seems like the first place a checker would disagree with a human reviewer.

The point that the agent and the human can read different versions of the same page is the part people underrate. A cheap check is to log a hash of the exact text the agent received next to its answer, so when it says something odd you can see right away whether it was fed hidden content or just reasoned badly. Treating fetched page text as data in its own clearly marked block, never mixed into the instructions, also cuts down how often hidden lines get followed.

The 0/132 result after rendering and keeping only visible text is a useful boundary: it prevents this specific hidden-line path, while your caveat about visible prompt injection still matters. For a practical pipeline, I’d preserve both views in a review artifact—rendered text plus a source-vs-rendered diff with the source URL and capture time—so reviewers can investigate rather than silently trust a sanitizer. I work on Orke at BOMTOBE, where we build a desktop workspace for AI agents, so this agent-facing boundary is directly relevant to my work.