The point that the agent and the human can read different versions of the same page is the part people underrate. A cheap check is to log a hash of the exact text the agent received next to its answer, so when it says something odd you can see right away whether it was fed hidden content or just reasoned badly. Treating fetched page text as data in its own clearly marked block, never mixed into the instructions, also cuts down how often hidden lines get followed.