BlvkWare.

What an HTML reader hands your model that you cannot see

An agent does not read a web page. A library reads it and gives the agent text. On 11 November 2026 one test page, carrying ten pieces of text a human visitor cannot see, was put through eighteen of those readers. Every library passed at least four of the ten through to the model. A real browser's own innerText passed four.

The hidden text on the test page is harmless. Each piece asks an AI assistant to include one marker word in its summary, so anyone can see which ones arrived. The page is public at blvkware.dev/cordon/test/, and the full result is a CSV at the end of this article. Run your own reader against it and compare.

The short version

• No general-purpose reader removed everything. Across the sixteen libraries, browser methods and hosted readers that are not built for this, the best result was four hidden markers out of ten and the worst was nine.
• Markdown converters are the most permissive. markdownify and html-to-text passed nine of ten. They are built to keep content, and to a converter hidden content is content.
• Article extractors do better, by accident. Mozilla Readability and readability-lxml passed five. They drop display:none and the hidden attribute, and nothing that hides text by size, position or colour.
• Rendering the page in a browser does not solve it. Chromium's innerText respects CSS, and still returned text set at zero size, text positioned off-screen, white text on a white page, and the Unicode-smuggled sentence.
• Three ways of hiding got past almost everything: zero font size, off-screen positioning and white-on-white each reached the output of every one of those sixteen readers.

The ten kinds of hidden text

What each reader passed

A red dot ● means the hidden marker was present in the text the reader returned. A small grey dot means it was not. Every reader returned the visible control marker, so each one did read the page.

Of the sixteen readers between the first row and the last: zero font size, off-screen and white-on-white passed all sixteen; the CSS class passed 14 of sixteen; Unicode tags passed 15 of sixteen; display:none passed 8 of sixteen; alt text passed 7 of sixteen. The HTML comment passed none of them. It is the one channel every reader already handles.

Why the browser does not save you

The usual answer to hidden text is to render the page and take what a person would see. Chromium's innerText is the closest thing to that, and it did drop what the parsers mostly kept: everything hidden with display:none or the hidden attribute, inline or through a class, plus the template and the alt text.

It kept the other four. Text at zero size is still laid out. Text ten thousand pixels to the left is still in the document. White text on a white background is, to the layout engine, text. None of those is hidden as far as the browser is concerned. They are only hidden as far as a person is concerned, and no API answers that question. The accessibility tree did no better, and added the alt text back.

Where CORDON fails

The last row is CORDON, which BlvkWare makes, and it is in the table on the same terms as the others. It passed two of ten.

• The CSS class. CORDON reads the hidden attribute and inline styles. It does not evaluate stylesheets, so a class that hides an element is invisible to it. Chromium's innerText gets this one right and CORDON does not.
• White on white. A colour is only hidden against a background, and CORDON does not compute backgrounds. It removes transparent text and does not remove white text, because on a dark page white text is the article.

In both cases the text reached the output, and CORDON's pattern rules still flagged it as an instruction addressed to an AI, which is why the page came back with a hostile verdict. A flag is not a removal, and the two markers count as passed.

What to do about it

• Find out what your own reader does. Fetch the test page with the tool your agent actually uses and search the result for canary-. It takes a minute and the answer is specific to your stack.
• Do not treat extraction as a security boundary. None of these libraries claims to remove hidden text. They are doing what they were built to do.
• Strip what no person can see before the model sees it. Inline hiding, comments, templates and invisible Unicode can be removed mechanically, with no judgement involved.
• Keep the other layers. Two of ten still got through the reader built for the job. An agent that can send data or spend money needs least privilege and an approval step whatever its reader does. AI agent permissions and safety covers that side.

Method and limits

• One page, one day. The fixture is a single short article. A reader's behaviour on it is its behaviour on these ten constructions, not a general score.
• Default settings. Each library was called the way its own documentation shows first, with no options. Several can be configured to drop more.
• Presence, not effect. A marker counts as passed if its text is in the reader's output. Whether a given model then acts on it was not measured.
• The Unicode channel. It counts as passed if the tag characters are still in the output. Models differ in whether they can read them.
• Versions. Library versions are in the table. Hosted readers were called on 11 November 2026 and may change without notice.
• Who ran it. BlvkWare sells one of the readers in the table. The page and the data are public so the result can be checked rather than trusted.

The data

The full matrix is in hidden-text-readers-2026-11.csv under CC BY 4.0: use it, cite this page. The test page is at /cordon/test/ and will stay at that address unchanged, so a later run can be compared with this one.

By William Russell Wheeler, BlvkWare. Measured 11 November 2026.