Problem. The only defense against instructions hidden in pages is wording in the tool description. Snapshot text includes invisible text (opacity 0, off-screen, clipped). The agent can type into password fields, fill forms that submit to other sites, and navigate to any URL with data in the query string.

Fix. Snapshot only visible text. Refuse typing into password fields, and into forms that submit to another origin. Agent navigation to a new origin needs user approval before the request is made.

Branch: feat/integrated-browser