Hidden-Text Prompt Injection in User-Supplied Documents

How the attack works

An attacker embeds override instructions in a document using invisible formatting: text colored to match the background, font size set to zero, CSS opacity set to zero, zero-width Unicode characters, or HTML comments. The document is then submitted normally, for example as a resume, article, or webpage to be summarized. An AI system processing that document reads the hidden text along with the visible content and may treat the hidden instructions as commands, such as overriding its safety rules or leaking data. The person or process that submitted the document sees only the normal-looking content and has no reason to suspect tampering.

Netzilo detection

Why it matters

An organization using AI to process external documents can have its AI agent silently redirected to ignore safety instructions, disclose sensitive data, or take unintended actions, without any visible sign in the document itself.

What you can do

• →Strip or normalize invisible formatting (zero-width characters, white-on-white text, zero-size fonts, CSS opacity/display tricks) from documents before passing them to an AI system.
• →Render or extract only the visible, human-readable text from documents rather than raw HTML or markup when feeding content to an LLM.
• →Treat instructions found inside user-supplied documents as untrusted data, not as commands, and keep them separate from system-level prompts.
• →Log and review cases where document content triggers unusual model behavior, such as sudden requests for PII or attempts to bypass stated policies.

Known benign look-alikes

• Normal summarization requests for articles or documents
• Benign coding requests unrelated to instructions
• Legitimate security questions about API security
• Translation requests
• Code review requests
• Test writing requests

References

• https://agentthreatrule.org/en/rules/ATR-2026-00515

Related threats