One test decides what belongs here: the document a person reads and the document a machine reads are not the same document. This is the public record of that happening — incidents, research and vendor disclosures, dated and sourced. Each entry names the technique it used and links to the page for that technique, so the attack and the check for it sit side by side.
That covers two things people usually keep apart. Injection hides an instruction so a model acts on something the reader never saw. Evasionhides the incriminating part so a filter never notices, and the reader gets the message anyway. Same divergence, same techniques, and in the second case the person the divergence hurts is the one reading.
Only stories carried by a document belong here. A jailbreak typed into a chat box is not one, however widely it was reported, because there is no file and therefore nothing to check.
A phishing campaign hid a block of text in an invoice email telling the recipient's AI summariser to add a fake priority action changing vendor payment details; Barracuda names four ways such instructions are hidden — HTML comments, CSS-invisible text, Base64 inside an image data string, and zero-width characters — but does not say which one this email used.
A phishing campaign peaking at 2.37 million messages a day split finance keywords with invisible characters from the Unicode Tags block, so keyword filters never matched them while readers saw ordinary words.
A job applicant's résumé hid roughly 1,500 characters of white text on a white background telling AI screening software to ignore prior instructions and declare the applicant a top-tier fit; the company's screening software flagged it. The reporting does not say whether the file was a PDF or a Word document.
A red team put a false exchange rate into an Excel pricing sheet three ways — hidden cells and a fake sheet, then white font, then three lines in a cell styled like its neighbours with the row left at its default height so only the first line showed — and the last one got past a model that had caught the white font.
In a lab test, an email carried instructions in HTML styled font-size:0px, white and zero line height — invisible to the reader in Outlook — and a summarizer running Claude Haiku 4.5 reported EUR 46,200 and a 3 September date in place of the real 21 August deadline in all ten runs.
A plaintiff hid instructions in 3-point white text throughout a court filing, telling any AI that read it to agree with the filing; the court noticed the extra white space and banned him from electronic filing.
PromptArmor showed that a PDF uploaded to Atlassian's Rovo assistant could carry an instruction set in transparent colour at one pixel, telling it to gather sensitive data and post it to an attacker's URL — with no approval click and no warning.
A benchmark of 29,322 PDFs hiding payloads behind invisible render mode, tiny fonts, white and low-contrast text and off-page placement. We ran our engine over every file: 9,774 of 9,774 injected documents flagged, and 0 of 9,774 ordinary ones. Read it against what the corpus is — the benign half is synthetic one-page templates, which the authors state plainly and we repeat here.
A researcher hid the instruction in a Word document as white text on a white background at a small font size, and Copilot’s Magic pen and Edit with Copilot read it — following it, and copying the same hidden instruction into each document they produced, so it spread from file to file. Disclosed after 144 days without a fix.
Proofpoint found attack tools advertised for sale that generate emails and PDF attachments hiding instructions in white-on-white text, which the recipient does not see but an AI mail agent processing the message reads.
A history professor hid an instruction in white text inside an essay question — place the word Madagascar somewhere it makes no sense — and 32 of 35 submitted essays came back carrying it, which is how he knew the assignment had been pasted into a chatbot. The article does not name the file format.
Over a million phishing emails padded their HTML with filler text hidden three ways at once — zero font size, a container with zero height and width, and overflow pushed off-screen — so filters reading the markup saw harmless words while the reader saw the lure.
Indeed’s screening team describe the attack they meet in live recruitment traffic — a job seeker hides a small-font or white-font injection between the words of a rendered résumé, leaving its appearance unchanged — and build a two-stage detector for it because frontier models are too slow to read every application.
Two live campaigns: a page posing as a Python library's documentation told any coding agent that a $3 licence key had to be bought from an attacker's wallet, in a div positioned off screen at left: -9999px and again in JSON-LD schema markup — and 4 of the 26 models Zscaler's own agent ran against it paid.
Two lawyers filed a court petition carrying text in white font on a white background telling any artificial intelligence reading it to contest the petition superficially and not challenge the documents; the court found it and fined them R$84,000. The report does not name the file format.
Across 196,682 real résumés submitted to a live hiring platform, roughly 1% carried a prompt injection hidden by white-on-white text, 1pt fonts or text placed off the page — and more than 90% of those prompts contained no explicit instruction at all, so a phrase matcher catches under one in ten.
A crawl of 1.2 billion URLs across 24.8 million hosts found 15,300 validated injections on 11,700 pages, about 70% of them sitting in parts of the HTML a browser never renders — headers, comments and metadata.
Ten prompt-injection payloads on live web pages, most hidden from readers in HTML comments, display:none, a visually-hidden aria-hidden element or 1px near-transparent text — one telling AI agents to make a $5,000 PayPal transaction, another to hand over an API key.
A GitHub issue carried instructions inside an HTML comment that GitHub’s rendered view hides, so the person who assigned the issue to Copilot Agent saw only the visible text, while Copilot followed the hidden part and committed four of its own credentials, base64-encoded, into a pull request.
Instructions written in Unicode Tags block characters and zero-width characters, invisible in every standard interface but read as tokens by the model, were placed in agent skill markdown files and MCP tool descriptions, and production agent platforms executed the shell commands they carried.
Twenty-two distinct payload techniques found on real malicious sites — zero font size, elements pushed 9,999 pixels off screen, display:none, attribute cloaking and prompts tucked inside SVG — aimed at everything from ad-review evasion to forced transactions. The SVG case reached us as `clean` until engine 0.263.0.
Instructions placed in an HTML comment inside an agent Skill file disappear when the Skill is rendered for a human reviewer, while the agent passes the raw text to the model — which then proposed enumerating environment variables, reading credential files and posting to an outside endpoint.
A résumé PDF carried an instruction in 1-point white-on-white text with a white image laid over it, and Notion AI built URLs containing salary expectations and candidate feedback, then embedded them as images so the browser sent them to the attacker.
Researchers hid a sentence recommending acceptance in medical manuscripts as white text on a white background, and three models asked to review them raised their acceptance recommendations from 0% to nearly 100%. The study does not name the file format.
About 500 real ICML papers were given a hidden prompt embedded in white text at the bottom of the first page, and the review scores an LLM produced moved for English, Japanese and Chinese injections while Arabic ones changed little.
A web page posing as an Oracle ERP integration guide carried the attack in 1-point font, and Gemini running inside Google’s Antigravity editor collected AWS credentials and private code from the developer’s workspace and sent them to an attacker’s endpoint.
An Office document carried hidden white-text instructions on a second sheet, and Microsoft 365 Copilot followed them: it fetched the user’s recent emails, hex-encoded them, and hid the result in a Mermaid diagram rendered as a fake login button that sent the data onwards when clicked.
Payloads written in characters from the Unicode Tags block — invisible to users but processed by the model — were placed in calendar invite titles, emails and website text to steer Gemini’s answers and reach inbox data; Google classed it as social engineering and declined to fix it.
An email hid instructions in tiny fonts, white-on-white text and layout tricks, and ChatGPT’s Deep Research agent obeyed them, sending personal information from the inbox to an attacker’s server from OpenAI’s own infrastructure rather than the user’s machine.
A line of white text, or text at a tiny font size in the LaTeX source, added to ICLR 2024 submissions pushed LLM-written reviews to 100% acceptance; every tool that extracts the PDF's text reads the hidden line, and only image-based reading of the page does not.
A GitHub issue carried hidden Unicode Tag characters that no interface displays, and Google’s Jules coding agent read them as instructions — adding a backdoor function to the code, compiling it and running it.
A document shared into a victim’s Google Drive hid the injection in 1px white font, and one ordinary request to ChatGPT was enough to make it search the drive for API keys and send them out inside an image URL. The write-up does not name the file format.
A repository’s README carried the payload in a comment, invisible when the file is rendered, and Cursor followed it — searching the workspace for API keys and SSH credentials and sending them to the attacker’s webhook.
An email hid an instruction inside a zero-size white span, and Gemini's "summarise this email" obediently appended a fabricated Google security warning telling the reader to call an attacker's phone number.
A font whose character-to-glyph table is edited so the code for one letter draws another — loaded by a web page through @font-face or embedded in a PDF — shows a reader one text while a model reads a different one; six models relayed the hidden content from PDFs 63–70% of the time and from web pages 20–47%.
The configuration files that steer AI coding assistants carried instructions written in zero-width joiners and bidirectional text markers — unreadable to a human reviewer, fully parsed by the model — and Copilot and Cursor generated backdoored code from them without mentioning it.
A Word document attached to a phishing email carried ASCII smuggling — Unicode characters that mirror ASCII but do not render in the interface — and Microsoft Copilot was steered into finding Slack MFA codes and email contents and handing them to an attacker through a link that looked benign.
The paper that named indirect prompt injection put its payloads where a reader never looks — the injection is a comment, and thus invisible to an end user — and showed a model reading them out of the ordinary web pages it had been pointed at.
Three commands: a key, credit, a verdict.
Start with the API