Roe 0.5 · by Windsec
Roe shows what a page, email, issue, file or image says to your agent that you can't see, which attack it matches, and which sensitive actions it's aiming at.
open source · github.com/WindSecurity/roe
One page, two readers
TRAVEL · 4 MIN READ
Winter is the best time to snag low fares. We compared hundreds of routes so you don’t have to.
LIS ↗
Lisbon
€49
MAA ↗
Chennai
₹4,150
OSL ↗
Oslo
€62
TRZ ↗
Thanjavur
₹5,600
FCO ↗
Rome
€38
CCU ↗
Kolkata
₹3,400
Book early, travel midweek and always clear your cookies
Not just visible text
Most tools only look at what's on screen. But text can be styled out of sight, tucked into attributes, or encoded in invisible characters. Roe narrows the question to the one that matters: is this page trying to give my agent orders?
Pages, email and files hide text in CSS, comments, attributes and invisible Unicode. Roe reads every one of those places and shows you what your agent would receive.
Polite text with no attack words is scored by the kinds of control it tries to take: a named agent, a standing rule, a trigger, a request to store or confirm.
Each finding names the attack it matches and the sensitive actions it could aim at: send, forward, delete, pay, edit rules files.
Nine families of agent attack
Rules cite their source: Morris II, EchoLeak CVE-2025-32711, GitHub MCP issue injection, memory poisoning, Rules File Backdoor.
Built for the browser
Unicode tag characters, variation selectors, zero-width binary and words split with soft hyphens are decoded and shown in plain text.
Each finding scrolls to the exact text and draws a butter-yellow marker with a red label, one box per line, without changing the page.
Titles, href, download and src attributes are checked, because agents read them as trusted metadata.
Fetches the raw Markdown an agent would receive, including HTML comments the page never shows. No cookies sent.
Every finished download is read from disk and scanned. A notification appears when something is found.
Warn only by default. Switch to removal mode and hidden nodes, comments and flagged attributes are stripped as they appear.
How it works
Page, email or file
Visible + hidden text
Invisible Unicode decoded
Passages joined
Behaviour scored
Mapped to actions
Warn, highlight or remove
Every page — http, https and file pages, including iframes; aware of email, GitHub, chat, tickets, docs and forums.
Images & downloads — up to 12 displayed images re-checked without cookies or referrer; results kept for the last 25 downloads.
File scanner — drag in files or a whole folder. Nothing is uploaded.
Two editions
Give the agent a task. Anything off-task is confirmed, or blocked if the session saw hidden instructions.
An agent that retries twice within 90 seconds after a block is probing policy. Every action is blocked until a person releases it.
An off-screen button a person cannot reach. An agent reading the DOM may click it — and gets caught.
Outbound text is scanned and matched against flagged passages, so replicating prompts are stopped at send.
Cloud keys, private keys, tokens, cards and SSN-like numbers are caught in pasted or typed text. Only the type is logged.
Approvals open in a separate window the page cannot restyle, with a 1.5 s dwell and a real click required.
We give a…
Roe is a browser extension by Windsec. It shows what a page, email, issue, file or image says to your AI agent that you can't see, which attack it matches, and which sensitive actions it could be aiming at. It can also remove the hidden text.
Single phrases cannot catch polite text. Roe scores the kinds of control a passage tries to take and needs two kinds, one of them core, before it flags. It reads whole passages, so instructions spread across an email are joined first.
No. Scanning happens in your browser. The GitHub raw check sends only owner, repo and issue number without cookies, and image re-checks are sent without cookies or referrer — both can be turned off.
Chrome 110 and newer, plus Chromium browsers like Edge, Brave and Arc. Load it unpacked from chrome://extensions with Developer mode on.
When your organization delivers a managed policy through MDM (Google Admin, Intune/GPO or ExtensionInstallForcelist). A managed policy overrides local settings and is read-only.
Yes. It is heuristic: paraphrased, translated or novel attacks can slip past, and ordinary notices can trigger weak false positives. It sees content only, not what an agent actually does, and text inside images needs OCR.
Get started
Clone the repo and open the extension folder
Open chrome://extensions → Developer mode on
Load unpacked → pick the folder with manifest.json
Click the Roe icon on any page
For download scanning, open Roe's Details in chrome://extensions and turn on “Allow access to file URLs”.