What are the signs that a document may contain prompt injection?

What documents tend to show prompt injection at the page level?

A document becomes suspicious when the visible content and the machine-readable content do not seem to agree. Hidden text, odd contrast tricks, layered fonts, and embedded instructions that are aimed at the model rather than the reader are all cues that the file may be carrying a separate prompt payload.

That mismatch matters because prompt injection is often designed to look like normal content while quietly redirecting the system’s behaviour. If the file is trying to influence the reviewer, not simply inform them, treat the document as hostile input until the instruction source and rendering path have been checked.

How do hidden or embedded instructions reveal themselves?

The most common signs are subtle presentation changes that human reviewers can miss on first pass. Text that appears only in certain rendering modes, very light or very dark text on a matching background, invisible characters, and unexpected OCR output all suggest that the document may contain content meant for the parser or model, not the human reader.

Instructional phrases are another strong indicator. If the document says things like ignore prior directions, summarise only this section, reveal system text, or follow the next command, that is a behavioural cue rather than ordinary subject matter. The same is true when a file contains conflicting layers, such as visible prose on top of hidden overlay text or metadata that disagrees with what is rendered.

For a practical testing approach, compare what the viewer shows with what extraction tools return. A document that looks bland to a person but yields extra text through OCR, copy-paste, accessibility extraction, or PDF-to-text conversion deserves closer scrutiny before it is passed into an AI workflow.

What should reviewers do when the indicators appear?

The safest response is to separate document handling from model instruction handling. A suspicious file should be treated as untrusted evidence, not as a source of operating instructions for the AI. That means checking the content in a plain-text or forensic view, isolating the file if needed, and verifying whether the strange text is accidental formatting, malicious prompt injection, or both.

When the document is part of a larger workflow, the review should focus on whether the file can alter the model’s task, tool use, or output boundary. A page that only describes a topic is different from a page that attempts to steer the system into exfiltration, policy evasion, or hidden action. If the latter is present, the file should be blocked from automated processing until it is cleaned or approved.

For practitioner context, the Prompt Injection Guide covers direct, indirect and multimodal attacks, including hidden Unicode and document-based injection patterns, and the Agentic AI Security Guide places those signals in the wider agent threat model. For examples where document or content poisoning led to real compromise patterns, see the EchoLeak (Microsoft 365 Copilot) 2025 and Gemini CLI prompt injection flaw 2025 cases.

Risk and Threat Considerations

Prompt injection in documents is risky because the attacker is not trying to break the parser in an obvious way, they are trying to smuggle instructions into a trusted input channel. That creates a trust-boundary failure: the system may treat attacker-controlled text as task guidance, which can lead to data exposure, unsafe tool use, or corrupted summaries and decisions.

Failure mechanism: The document carries hidden or conflicting instructions that survive normal ingestion, then influence the model’s interpretation, retrieval, or action selection. In stronger cases, the payload is crafted to look like ordinary text while targeting OCR, accessibility extraction, or downstream agent reasoning.

Impact: The model may follow attacker instructions, reveal sensitive context, ignore policy constraints, or produce outputs that appear legitimate but are adversarially steered. In agentic workflows, the blast radius can extend beyond bad text generation to tool misuse, account misuse, or unwanted actions.

Practitioner Guidance

What to verify: Compare the rendered document, extracted text, OCR output, and copied text before trusting the file. A genuine business document should not change meaning materially across those views; if it does, treat the discrepancy as a security signal.

Decision rule: If the file contains instructions directed at the AI, hidden overlays, or text that exists only in extraction artifacts, do not pass it straight into an automated agent. Route it through manual review or a hardened sanitisation step first.

Practitioner takeaway: The key judgement is not whether the document looks suspicious to a person, but whether it tries to influence the model’s behaviour instead of merely describing its subject. When that boundary is unclear, assume adversarial intent until the file is proven safe.

Related resources from NHI Mgmt Group

• What is the difference between prompt injection risk and identity abuse in agents?
• What are the signs that a file may contain hidden prompt injection or invisible instructions?
• What are the signs that an agent-to-tool integration is failing to contain prompt injection?
• How should security teams contain prompt injection in agentic systems?