Text encoded inside a data: address
An image address that holds a sentence instead of a picture. The reader sees a broken image or nothing, and a model told to decode the source reads the words.
How the text is hidden
A data: URI puts a resource's bytes in the markup itself, as <img src="data:image/png;base64,…"> or a stylesheet's url(data:…). Nothing obliges the bytes to be what the label says. Encode a sentence in Base64 or percent-encoding and put it where an image address goes, and the browser draws a broken image or nothing at all while the document's source holds the sentence. Barracuda reported this in October 2026 on phishing emails aimed at the recipient's AI assistant: instructions "buried inside encoded blocks, such as an image data string".
Why a model still reads it
The words are not in the page's text, so a plain extractor does not return them either. They reach a model when something decodes the source: a model handed the raw HTML and asked to read everything in it, or a pipeline that unpacks embedded resources. The attacker relies on the reader never seeing a sentence where a picture should be.
What we do about it
Every data: URI in any attribute of any element, and in any stylesheet, is decoded: Base64 or percent-encoding, under its declared charset. Bytes that are binary, such as a real image or a font, are left alone. Bytes that decode to text are reported at high with action strip, so the decoded words are left out of text.canonical and the caller's model never receives them. R-5a still reads them. Markup inside the payload, such as an SVG, gives up its text, comments and any data: URI nested inside it. The declared media type never silences a finding on its own: prose labelled image/png or text/javascript inside an image is reported. Measured at engine 0.342.0, it fires on none of 8,978 real web pages and emails. Planted into those documents, it caught every payload that landed in markup a reader is shown except one, in a message whose declared charset this parser misreads.
How often it fires
0% of Common Crawl — 399 real web pages as published, skewed to low-quality domains, measured 2026-10-12.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A phishing campaign hid a block of text in an invoice email telling the recipient's AI summariser to add a fake priority action changing vendor payment details; Barracuda names four ways such instructions are hidden — HTML comments, CSS-invisible text, Base64 inside an image data string, and zero-width characters — but does not say which one this email used.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API