Tag characters survive both of the places you would look for them. The block from U+E0000 to U+E007F renders as nothing at all [1], and copying the page into a text editor gives you whitespace [2]. A tokenizer is less fastidious.
That is why the author's evidence framing holds up. Hidden text addressed to a language model sitting in a page's DOM is itself the evidence [13]; the attempt is a classification signal, and Sentinel passes it forward rather than silently stripping it [12]. That is a logging behavior, though, and the pipeline's actual safety comes from two rules downstream.
Scraped content is treated as adversarial and never concatenated into a prompt, and the rule extends to text rendered inside images, because the pipeline hands Playwright screenshots to Gemini as inline_data for multimodal classification [14]. Then the model classifies but never selects a recipient: destination channels are a closed enum, and the address is resolved in code from RDAP plus a fixed table plus an allowlist [15]. Tested against the real Gemini API rather than a mock, an injection planted in an RDAP response produced an empty final address instead of a redirected one, because the value had no field to land in [16].
The bug the author found in his own code is the more portable lesson. RDAP is deterministic, which he had read as grounds for trusting its output, and an abuse field can come back holding "[email protected], [email protected]" [17]. A deterministic protocol only guarantees the shape of the response; who actually supplied the contents is a separate question it never answers.
The economics are what make the cascade necessary rather than tidy. Millions of certificates a day cross the Certificate Transparency feed [6], where a new HTTPS domain shows up seconds after registration [5]. At roughly $0.001 per investigation, classifying a million of them naively costs about $1,000 a day to surface maybe a few dozen real threats [7]. Layer 1 discards about 99% before anything with a token cost touches them [8], and the second semantic sieve runs locally at no per-call cost [9]. That leaves on the order of 10,000 paid investigations, roughly $10 a day [20], about a hundredth of the naive bill [21].
For that number to transfer to your queue, the discarded 99% has to contain none of the domains you needed, and the write-up does not say what Layer 1 keys on. It is a claim about one testbed's threat set. The fail-open rule pushes the other way: if Ollama is down, domains proceed to full investigation instead of being dropped [10], so an outage in the free layer arrives as spend in the paid one. Every token-spending operation emits a cost metric [11], which is the only reason these figures can be checked at all.
The baseline being attacked is manual: detect, investigate, screenshot, find the registrar, write the notice, follow up, hours to days per domain while the site keeps earning [18]. Sentinel runs that as a fleet on Google Cloud and calls a human exactly once, for the only irreversible action [22]. It is also a hackathon entry, written for Google's All Things Agentic Hackathon in the Fortified Enterprise Fleet track [19], which is worth holding in mind next to the cost table.
