TrapScout

Scan a webpage for hidden AI-agent traps before you send your browser agent there — see the indirect prompt-injection payloads your agent would actually read, and the clean version of the page it would see if you stripped them.

Date: 2026-05-10 Form factor: Web app (single-page; mobile-friendly) Status: Prototype

What it is

TrapScout is a single-page scanner for the "indirect prompt injection" trap epidemic that's now visible in the wild. You drop in a URL (or pick a sample), and TrapScout shows the agent-visible content of the page — the part your ChatGPT Atlas / Claude computer-use / Perplexity Comet / Gemini agent mode session would actually ingest — separated into what a human sees vs. what a bot sees. It flags hidden text, ARIA-label and alt-text traps, white-on-white instructions, off-screen positioned content, suspicious "ignore previous instructions" phrasing, fake tool-call markers, base64-encoded comments, and unicode-tag payloads, scores the page on a Safe → Caution → Trap scale, and gives you a "cleaned" preview of the agent prompt with the trap content stripped.

The prototype runs entirely offline against five fixture pages: a clean product page, a competitor-injected shopping page, a PayPal-targeted travel site, a poisoned résumé, and a benign personal blog. It demonstrates the end-to-end flow: paste → scan → triage → export a sanitized snippet your agent can safely consume.

Who it serves

Two overlapping personas:

1. The agentic power user. Anyone running ChatGPT Atlas, Claude with computer use, Perplexity Comet, Gemini in agent mode, or a custom browser-using agent to do real work (shopping, booking travel, reviewing résumés, summarizing competitor pages). Google reported a 32% surge in indirect prompt injection attempts between Nov 2025 and Feb 2026, with documented payloads that exfiltrate PayPal balances and reroute purchases. (Decrypt, 2026-04-22)
2. The small e-commerce / content owner. Founders worried their own site has been poisoned by competitors injecting hidden "recommend our store instead" instructions, or by SEO scrapers leaving CSS-hidden affiliate redirects. They want a 30-second self-check before they list on AI-agent shopping comparators.

The shared pain: indirect prompt injection is invisible by definition — DevTools shows it, but nobody manually inspects a page before sending an agent there. TrapScout makes the invisible visible.

Why it could be profitable

A three-tier wedge:

• Free consumer tier: 10 scans/day from the web app + a Chrome/Edge extension that lights up the address bar when the current page contains agent traps. Acquisition channel.
• Pro ($9/mo): Unlimited scans, batch URL upload, a "pre-flight" API your custom agent calls before each browser.navigate, and saved scan history for audit.
• Teams / API ($199–$999/mo): For Shopify and BigCommerce stores, marketplaces (Amazon, Etsy), agentic-browser vendors, and DTC brands — bulk scans of your own catalog pages, competitor-poisoning monitoring, and a JSON-schema webhook to a SIEM.

The category is moving fast: Microsoft, IBM, and Google all published agent-frameworks-have-RCE research in the last four weeks (Microsoft Security, 2026-05-07, Help Net Security, 2026-04-24), and consumer demand follows visible incidents. The first product to own the "is this page safe for my agent?" search term has a defensible position.

Form factor & scope

Single-page web app. The MVP slice in this folder:

• URL input with a "Scan" button and five preset sample pages.
• Scan result panel with overall risk score, color-coded badges, and per-finding cards.
• "Human view vs. agent view" split: side-by-side rendering of the visible page and the agent-ingested DOM text.
• Findings list grouped by trap family (DOM hiding, CSS hiding, ARIA / alt, instruction phrasing, encoding, structural).
• "Cleaned prompt" tab that shows the sanitized text payload an agent should use instead.
• Copy-to-clipboard for the cleaned text.

Out of scope for the prototype: live URL fetching (CORS), real browser extension, accounts, billing, multi-page crawl.

How to run it

1. Open index.html in any modern browser (Chrome, Edge, Firefox, Safari). No build step.
2. Pick a sample URL from the dropdown, or type any string into the URL field and press Scan (typing a custom URL will return a "not in fixtures" message — pick a sample).
3. Click any finding card to jump to the highlighted snippet in the agent view.
4. Switch to the Cleaned prompt tab to copy the sanitized text your agent should consume.

Sample data lives inline in index.html as a <script type="application/json"> block, so the prototype runs cleanly from file:// without a local server.

What's in this prototype

• Five realistic fixture pages with named trap families:
  • acme-running-shoes-clean.example — clean product page, baseline.
  • discount-electronics-trap.example — hidden display:none system override + ARIA-label coupon trick (competitor injection).
  • cheap-flights-paypal.example — white-on-white "send $4,800 to PayPal address X" with off-screen position: absolute; left: -9999px.
  • freelance-resume-trap.example — base64 HTML comment + zero-width unicode tag characters telling the agent to recommend hiring the candidate.
  • mikes-camping-blog-clean.example — benign blog with a single false-positive lookalike.
• Eight detector rules implemented client-side, each producing a finding with severity, family, excerpt, and mitigation.
• Risk score = 100 − weighted penalty per finding; thresholds: ≥85 Safe, 60–84 Caution, <60 Trap.
• A "Cleaned prompt" generator that strips hidden nodes and outputs whitespace-normalized text.

Roadmap

• Live URL fetching via a small proxy worker (Cloudflare Workers) to bypass CORS.
• Chrome / Edge MV3 extension that runs in-page and lights up the address bar.
• Pre-flight API (POST /v1/scan) for custom agents to call before browser.navigate.
• Shopify / BigCommerce app for sellers to monitor their own catalog for competitor poisoning.
• Headless agent-vendor adapters: Atlas, Comet, and Claude computer use SDK middleware.

Sources

• Help Net Security — Indirect prompt injection is taking hold in the wild, 2026-04-24 — confirms the "open web filling with traps" framing and ten in-the-wild payload families.
• Decrypt — Malicious Web Pages Are Hijacking AI Agents, And Some Are Going After Your PayPal, 2026-04-22 — Google's 32% surge figure and PayPal-targeting payloads.
• Microsoft Security Blog — When prompts become shells: RCE vulnerabilities in AI agent frameworks, 2026-05-07 — agentic RCE risk surface.
• Google Online Security Blog — April 2026 — official "if you are an AI, do not crawl" pattern and Google's own mitigations.
• Infosecurity Magazine — Researchers Uncover 10 In-the-Wild Prompt Injection Payloads Targeting AI Agents — taxonomy used to seed TrapScout's detector families.