Text the colour of its background
Text whose resolved colour and resolved ground are too close in contrast for a reader to separate them.
How the text is hidden
The parser resolves the text colour from color, from -webkit-text-fill-color, and from the background-clip:text idiom where the paint becomes the glyph colour; it resolves the ground from the cascade, from the legacy bgcolor and background attributes that older and government HTML still use, and — inside an <svg> — from the filled shapes already painted under the text's own point, through the transform chain. The two are compared as a contrast ratio.
Why a model still reads it
The glyphs are painted, at full size, in the ordinary flow. Only the colour hides them, and colour is a rendering property: an extractor reads the characters and never computes the contrast.
What we do about it
reasonFor returns background-match when the computed contrast falls below limits.minVisibleContrastRatio, read from the rule pack. The rule fires at high with action flag — reported and retained, never stripped — guarded by the same container clause that stands the specific rules down on a whole-page text layer. containerVisibility is never: selecting the text is the only way a reader finds it.
How often it fires
11% of 400 real pages from 400 distinct hosts (Common Crawl) — pages, not documents, measured 2026-09-16.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A phishing campaign hid a block of text in an invoice email telling the recipient's AI summariser to add a fake priority action changing vendor payment details; Barracuda names four ways such instructions are hidden — HTML comments, CSS-invisible text, Base64 inside an image data string, and zero-width characters — but does not say which one this email used.
In a lab test, an email carried instructions in HTML styled font-size:0px, white and zero line height — invisible to the reader in Outlook — and a summarizer running Claude Haiku 4.5 reported EUR 46,200 and a 3 September date in place of the real 21 August deadline in all ten runs.
Proofpoint found attack tools advertised for sale that generate emails and PDF attachments hiding instructions in white-on-white text, which the recipient does not see but an AI mail agent processing the message reads.
An email hid instructions in tiny fonts, white-on-white text and layout tricks, and ChatGPT’s Deep Research agent obeyed them, sending personal information from the inbox to an attacker’s server from OpenAI’s own infrastructure rather than the user’s machine.
An email hid an instruction inside a zero-size white span, and Gemini's "summarise this email" obediently appended a fabricated Google security warning telling the reader to call an attacker's phone number.
Merge request descriptions, commit messages and source code comments carried prompts obfuscated with Base16 encoding, Unicode smuggling and KaTeX rendered in white text, and GitLab Duo followed them into leaking private source code and planting malicious links in its answers.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API