One test decides what belongs here: the document a person reads and the document a machine reads are not the same document. This is the public record of that happening — incidents, research and vendor disclosures, dated and sourced. Each entry names the technique it used and links to the page for that technique, so the attack and the check for it sit side by side.
That covers two things people usually keep apart. Injection hides an instruction so a model acts on something the reader never saw. Evasionhides the incriminating part so a filter never notices, and the reader gets the message anyway. Same divergence, same techniques, and in the second case the person the divergence hurts is the one reading.
Only stories carried by a document belong here. A jailbreak typed into a chat box is not one, however widely it was reported, because there is no file and therefore nothing to check.
A phishing campaign peaking at 2.37 million messages a day split finance keywords with invisible characters from the Unicode Tags block, so keyword filters never matched them while readers saw ordinary words.
A plaintiff hid instructions in 3-point white text throughout a court filing, telling any AI that read it to agree with the filing; the court noticed the extra white space and banned him from electronic filing.
PromptArmor showed that a PDF uploaded to Atlassian's Rovo assistant could carry an instruction set in transparent colour at one pixel, telling it to gather sensitive data and post it to an attacker's URL — with no approval click and no warning.
A benchmark of 29,322 PDFs built from 4,983 real documents, injecting payloads through invisible render mode, tiny fonts, white and low-contrast text and off-page placement — every one of which is a technique we detect.
A researcher showed that small white text in a Word document could tell Copilot to alter financial figures and copy the same instructions into every document it generated — a worm, disclosed after 144 days without a fix.
Over a million phishing emails padded their HTML with filler text hidden three ways at once — zero font size, a container with zero height and width, and overflow pushed off-screen — so filters reading the markup saw harmless words while the reader saw the lure.
Across 196,682 real résumés submitted to a live hiring platform, roughly 1% carried a prompt injection hidden by white-on-white text, 1pt fonts or text placed off the page — and more than 90% of those prompts contained no explicit instruction at all, so a phrase matcher catches under one in ten.
A crawl of 1.2 billion URLs across 24.8 million hosts found 15,300 validated injections on 11,700 pages, about 70% of them sitting in parts of the HTML a browser never renders — headers, comments and metadata.
Twenty-two distinct payload techniques found on real malicious sites — zero font size, elements pushed 9,999 pixels off screen, display:none, attribute cloaking and prompts tucked inside SVG — aimed at everything from ad-review evasion to forced transactions. The SVG case reached us as `clean` until engine 0.263.0.
A résumé PDF carried an instruction in 1-point white-on-white text with a white image laid over it, and Notion AI built URLs containing salary expectations and candidate feedback, then embedded them as images so the browser sent them to the attacker.
An email hid an instruction inside a zero-size white span, and Gemini's "summarise this email" obediently appended a fabricated Google security warning telling the reader to call an attacker's phone number.
Three commands: a key, credit, a verdict.
Start with the API