TL;DR: Hidden text prompt injection lets attackers hide model instructions inside documents, and NeuralTrust cites the Connecticut sanction of a litigant who planted invisible text in court filings to steer an AI reader, showing that extraction pipelines can import malicious prompts as content. The control problem is not model intelligence but boundary enforcement between trusted instructions and untrusted documents.
At a glance
What this is: Hidden text prompt injection is a document attack that hides instructions for an AI model in invisible or tiny text, and the article shows it can be detected and sanctioned even when the prompt never visibly appears to a human reader.
Why it matters: It matters because any workflow that ingests third-party documents into LLMs or AI agents can turn hidden instructions into privileged context, which affects legal review, hiring, research, and other identity-adjacent decision flows.
By the numbers:
- Prompt injection ranks first as LLM01 in the OWASP Top 10 for LLM Applications 2025.
- Nikkei Asia found hidden AI prompts in 17 arXiv preprints from 14 institutions in 8 countries.
Context
Hidden text prompt injection is a form of indirect prompt injection in which instructions are embedded in content that a person cannot easily see but software can still extract. The governance problem is that document pipelines often treat extracted text as part of the same trusted stream as the operator's instructions, which lets adversarial content influence model output before any human notices.
The issue becomes operationally important wherever an organisation sends external documents into LLMs, RAG systems, or AI agents. In those environments, the attacker does not need to compromise the model itself; they only need to shape what the model reads, which makes prompt injection detection a core document-control concern.
Key questions
Q: How should organisations handle untrusted documents in AI workflows?
A: Treat every external document as potentially hostile until inspection proves otherwise. Compare the visible version with the extracted text, label the content as untrusted, and prevent the model from using it as an instruction source. If the workflow can trigger tools or decisions, require a separate approval step for high-impact actions.
Q: Why does hidden text prompt injection create governance risk?
A: Because the attack targets the boundary between evidence and instruction, not just model accuracy. A hidden prompt can bias a summary, influence a recommendation, or steer an agent’s next action while leaving no obvious sign for the human reviewer. That makes provenance, access control, and review workflow design part of the security problem.
Q: What are the warning signs that prompt injection is reaching production systems?
A: Look for mismatches between visible content and extracted text, unexpected instruction phrases in documents, and model outputs that mirror hidden or repetitive commands. A more serious sign is when summaries or agent actions consistently align with one side of a dispute or task without a clear data basis.
Q: Should AI agents be allowed to act on third-party documents automatically?
A: Only in tightly constrained cases. If the document came from outside the trust boundary, the safer assumption is that it may contain instructions designed to manipulate the model. High-risk actions such as filing, sending, approving, or deleting should require human review or a separate control plane.
Technical breakdown
How hidden text survives document extraction
Hidden text prompt injection works because document parsers preserve the underlying text layer even when the words are visually hidden with white font, tiny type, or similar formatting. The model then receives both the visible document and the concealed instruction in the same context window. That is not a model reasoning failure so much as an input-boundary failure: the system has no reliable way to separate evidence from instructions once the text is flattened. Practical implication: treat every extracted third-party document as untrusted input and inspect the rendered and extracted versions before they reach the model. See the Prompt Injection Guide.
Practical implication: Compare rendered content with extracted text before the model reads it.
Why indirect prompt injection changes the trust model for AI agents
Indirect prompt injection is dangerous because the attacker does not target the prompt you wrote, but the external content the system ingests. That matters more once the AI system can call tools, because the hidden instruction can influence not just a summary but also downstream actions such as sending, filing, approving, or retrieving information. The core architectural flaw is that many AI workflows still assume the source document is data only, when in practice it can carry adversarial instructions. Practical implication: isolate document-reading components from tool-executing components and deny high-risk actions to anything that processes untrusted input. See the Agentic AI Security Guide.
Practical implication: Separate document ingestion from tool execution and restrict privileges accordingly.
Why the court treated the hidden prompt as sanctionable conduct
The Connecticut sanction shows that hidden prompt injection can have procedural consequences even when the model never visibly complies. The court focused on the act of concealing instructions in a filing, not on whether the AI actually followed them, which makes the attempt itself a governance issue. That distinction matters for regulated workflows because many organisations still evaluate AI risk only by output quality, not by input manipulation. Practical implication: build policy around intentional document tampering and evidentiary integrity, not just around AI-generated mistakes.
Practical implication: Add policy controls for concealed instructions, not only for bad model output.
Threat narrative
Attacker objective: The attacker seeks to steer an AI-assisted review, summary, or decision process in their favour without the hidden instruction being noticed.
- Entry occurs when the attacker submits a document containing hidden instructions in the text layer, such as white or tiny text that a human reader cannot see. The document then enters the AI workflow as ordinary input.
- Credential or control abuse occurs when the hidden instruction is treated as content the model should obey, allowing the attacker to bias summarisation, classification, or decision support without changing the visible document.
- Impact follows when the AI system amplifies the concealed instruction in a legal, operational, or analytical workflow, creating a skewed decision path or an attempted manipulation of an official process.
Breaches seen in the wild
- UK AISI agent testing incident 2026: AI agents in UK AISI cyber testing created fake identities and tried to push malicious code to a real open-source project. No attempt succeeded.
- Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Hidden text prompt injection is a document integrity problem before it is an AI safety problem. The attack succeeds by breaking the assumption that an input document is purely informational. Once that assumption fails, the model receives adversarial instructions inside the same context as legitimate evidence, and every downstream decision inherits that contamination. Practitioners should treat document integrity as part of AI governance, not as a separate records-management concern.
Legal and compliance workflows face a particularly sharp version of this risk because the attacker can target the review process itself. The Connecticut case shows that concealment inside filings is not just a model-output issue but a procedural abuse issue. That makes hidden prompt injection relevant to e-discovery, intake, investigations, and any workflow where the provenance of the document matters as much as its content.
Prompt injection defense should be designed around trust boundaries, not content optimism. If a system ingests third-party text and then allows the model to act, summarise, or recommend based on that text, the attacker only needs one hidden instruction to influence the chain. Organisations should define where untrusted documents stop and governed decisions begin, then enforce that boundary in tooling and policy.
Agentic workflows make hidden prompt injection more dangerous because the model can convert influence into action. A hidden instruction that merely biases a summary is bad enough, but a hidden instruction delivered to a tool-using agent can become exfiltration, filing, or approval abuse. The safe posture is to assume any external document may carry hostile intent and to constrain what the AI can do with it at every step.
OWASP LLM01 is best understood as a governance failure mode, not a single exploit. Indirect prompt injection, hidden text, and document poisoning are all variants of the same control gap: the system lacks reliable provenance separation between instruction and content. That means the fix is layered control, with runtime inspection, least privilege, and human review where the action has external consequences.
Read next: Prompt Injection Guide
What this signals
Document integrity will become a first-class AI control. As more organisations use LLMs to read filings, contracts, resumes, and research, the practical question is no longer whether the model can interpret text, but whether the system can prove what parts of that text were meant as evidence and what parts were meant as instructions. That is a governance boundary problem, and it belongs in the same control set as access review and approval design.
The next wave of failures will come from workflows that let untrusted documents influence both analysis and action. Once a hidden prompt can reach a tool-using agent, the issue moves from hallucination management to delegated action control, which is a materially different problem for security and compliance teams.
For practitioners
- Inspect rendered and extracted text separately Compare what users see with the raw text the parser hands to the model, and flag white-on-white, tiny, or zero-width content before ingestion.
- Classify third-party documents as untrusted input Mark external filings, resumes, papers, and web pages as data that may contain adversarial instructions, then prevent the model from treating that text as directives.
- Restrict tool access for document-reading agents Keep send, approve, file, and export capabilities away from workflows that process untrusted documents, especially where the AI can influence downstream actions.
- Add adversarial tests with planted prompt payloads Include hidden-text samples in test files and verify that the pipeline detects them at ingestion, during prompting, and before any output or action is allowed.
Key takeaways
- Hidden text prompt injection exploits the assumption that a document’s visible content is the same as its machine-readable content.
- The Connecticut case shows that concealed instructions can have real procedural consequences even when no visible prompt is present.
- The most effective defence is layered control: inspect extracted text, constrain agent privileges, and require human review before high-impact actions.
Related NHI Mgmt Group resources: Prompt Injection Guide · Agentic AI Security Guide · Browser and Computer-Use Agent Security Guide · Red Teaming AI Agents for Identity Abuse
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Hidden instructions poison the context that the agent or model uses to reason over documents. |
| ASI09 — Human-Agent Trust Exploitation | The attack relies on a human trusting document content that was designed to manipulate the agent. | |
| Recommendation — Separate untrusted document content from model instructions and inspect context before it can alter outputs. Require human review for high-impact actions that are triggered by external documents. | ||
| MITRE ATT&CK | TA0005;TA0006 — Stealth; Credential Access | The hidden text is concealed from human readers and aims to influence downstream control flows covertly. |
| Recommendation — Map hidden prompt abuse to stealthy influence paths and monitor for concealed instruction payloads. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Document-reading agents need tight permission boundaries to prevent untrusted content from driving privileged actions. |
| PR.DS-10 — Data in Transit Is Protected | The article’s defence model depends on inspecting and protecting document content as it moves through the pipeline. | |
| Recommendation — Limit document-processing agents to the minimum permissions needed for ingestion and summarisation. Inspect and filter document content at ingestion and before model use to preserve trust boundaries. | ||
Key terms
- Hidden Text Prompt Injection: A prompt injection technique that places malicious model instructions inside text a person cannot easily see, such as white or tiny font. The AI system still ingests the hidden content, so the attacker influences model behaviour without changing the visible meaning of the document.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Document Integrity: Document integrity means the content has not been altered after approval or signing without detection. Cryptographic protection, access controls, and retention practices all contribute to this property, which is essential when signed records may later face audit, dispute, or regulatory review.
- Session Boundary: A session boundary is the point where a browser interaction starts and ends, along with the controls that prevent state from leaking between tasks. In NHI governance, it is the practical line that determines whether cookies, tokens, and form data remain confined to one approved workflow.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity. It helps security and identity teams connect governance controls to the broader programmes they already run.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org