Indirect Prompt Injection: How Invisible Text Can Hijack Your AI Assistant

The Attack You Never See Coming

Indirect prompt injection happens when malicious instructions aren't typed by the user at all — they're hidden inside content the AI reads on the user's behalf: a webpage, an email, a PDF, a comment buried in a code file. The AI is asked to do something ordinary, like summarize a message or answer a question about a page. Somewhere in that content, invisible to the human, sits a hidden command. Because current AI systems can't reliably distinguish between the data they're processing and instructions they're meant to follow, the model often just does what the hidden text says.

Security researchers at Forcepoint X-Labs demonstrated exactly this in an August 2026 proof of concept. They built a simple, unguarded email summarization pipeline — an Outlook add-in that pulled an email's headers and body into a single prompt sent to an LLM. They then planted a hidden instruction using HTML styling that made the text invisible to the reader in Outlook but fully present in the content sent to the AI. Across ten trials, the injected email's summary consistently reported a fake deadline and omitted a name the injected instructions had asked it to hide — with, in the researchers' words, "no signalling tampering to the reader."

The Techniques Attackers Actually Use

Common concealment methods include zero-size fonts, matching text and background colors, HTML comments, and hidden metadata tags.

Forcepoint's broader research this year documented the technique already active on live, publicly accessible websites — not just in a lab. Attackers weaponized HTML comments, metadata tags, 1-pixel fonts, transparent text colors, and even accessibility layers meant for screen readers to conceal instructions from human view while keeping them fully machine-readable. In real cases the researchers found, hidden commands enabled the deletion of backup folders, illicit transfers through payment links, and forced exposure of secret API keys.

Google's independent research reached a similar conclusion at much larger scale. Scanning 2 to 3 billion crawled web pages a month, Google's DeepMind security team documented a 32% jump in malicious indirect prompt injections over a three-month period. Not every hidden instruction is malicious — Google found some are pranks or genuinely helpful nudges, like telling an AI to adopt a certain tone — but the volume of harmful payloads, including ones built specifically to trigger financial fraud, is rising fast enough that OWASP has ranked prompt injection the top risk facing LLM applications every year since 2023.

Every Major AI Lab Has Conceded This Point

This isn't a bug waiting for a patch — it's closer to a structural property of how current AI systems process text. There's no cryptographic signature distinguishing a legitimate system instruction from a malicious one buried in a webpage; it's all just text, and the model has no built-in way to verify who's actually speaking. OpenAI's chief information security officer Dane Stuckey called it "a frontier, unsolved security problem" in October 2025. The U.K.'s National Cyber Security Centre has gone further, warning businesses to plan around the assumption that AI systems will eventually be confused by this kind of attack, not merely hope they won't be.

The risk scales sharply with what the AI is allowed to do. As Forcepoint senior researcher Mayur Sewani put it: "A browser AI that can only summarize is low-risk. An agentic AI that can send emails, execute terminal commands or process payments becomes a high-impact target." Because the industry's near-universal conclusion is that this can't be fully prevented at the model level, the realistic defense every major lab now points to is limiting what an AI is allowed to do unsupervised — not eliminating the possibility of a successful injection, but shrinking the damage one can cause.

How to Actually Protect Yourself

This Isn't Just Theoretical Research

Indirect prompt injection has moved from academic proof-of-concept to documented real-world incidents against production AI systems, which is part of why security researchers treat it as an active, ongoing risk rather than a hypothetical edge case. Security researchers have publicly disclosed successful injection attacks against AI browser assistants, email-summarization tools, and document-processing agents — cases where a piece of hidden text embedded in a webpage, PDF, or email caused an AI system to take an unintended action or leak information it shouldn't have. Several AI labs have run public bug-bounty programs specifically targeting prompt injection vulnerabilities in their own products, which is itself a signal of how seriously the issue is being treated internally, even as public messaging sometimes downplays the risk to avoid alarming users of AI-powered tools.

The trend line matters more than any single incident: as AI agents are given more real-world capability — browsing autonomously, managing email, executing code, handling financial transactions — the potential blast radius of a successful injection grows correspondingly. This is why security teams increasingly treat "can this AI agent be tricked by hidden text" as a standard question to ask before deploying any AI tool with real-world permissions, rather than a concern reserved for unusually sensitive applications.

Frequently Asked Questions