Build a reproducible local lab that exposes a browser agent to hidden prompt injection, records its actions, and compares behavior before and after defensive restrictions.