The interview angle

How does an agent read a web page: DOM or screenshot?

Both are used, and they fail differently. The page source or accessibility tree is cheap, searchable, gives names and addresses of controls, and shows hidden text a person cannot see, which is the injection surface. A screenshot is what a person sees, handles pages the text cannot describe (painted text, canvases, icons), and costs a fixed number of tokens per look, but it needs coordinates (so it needs scaling and zoom handling), cannot see below the fold or under a pop-up, and misses small targets. A reliable system usually mixes them. Say what you know about what your framework strips from the source.

How would you secure a browser agent that can reach a user's accounts?

Do not rely on the model to resist. Run the browser in an isolated environment with minimal privileges; keep credentials out of the model's context and fill them in the browser by host; limit the hosts the agent may reach by exact match; fix the writes a task may make before reading any page, and give read-only tasks none; ask the person to confirm irreversible actions with details built from the request, and ask rarely; give the agent only what the task needs; log everything. Then add the model-side defences (training, classifiers, red-teaming) as a layer, not as the layer. Say what stays unsolved: an instruction that asks for something inside the task, and a person who stops reading prompts.

Why can't you just filter out the malicious text?

Because the attacker writes in the same language as the data, and a filter is a guess. A pattern list catches the wording you thought of, a classifier catches more and still misses some, and hidden text can sit where your filter does not look (a label, an image, painted pixels). Filters help; put the control where the action happens (host, contract, confirmation, credential), where you do not need to understand the sentence.

How would you evaluate a browser agent?

On the state of the world, not on what the agent says. A task has a success test (the order exists, the mail went to the right person) and a harm test (nothing happened that was not asked for, no private value reached the wrong host). Run the same tasks under page features that break agents (banners, late loading, icon-only buttons, hidden look-alikes), under injected instructions in several places, and report each separately; success and harm are different columns.