A web page now has two readers: the person who sees it and the artificial intelligence (AI) assistant that reads every character underneath. Ask an assistant to summarise a page, an email or a report, and it takes in everything, including white text on a white background, letters from a block of Unicode that displays nothing, and short notes addressed to the machine. When those hidden words are instructions, the assistant may follow them. The name for this is prompt injection.
An old trick with a new reader
Hidden text is older than chatbots. Google’s spam policies for Search list white text on a white background as a way of hiding content from people while search software still reads it. The same trick now aims at the software that reads pages for people.
The Open Worldwide Application Security Project, a non-profit community that publishes open lists of software security risks, places prompt injection first in its 2025 Top 10 for applications built on large language models, the systems behind today’s assistants. On 8 December 2025 the United Kingdom’s National Cyber Security Centre described these models as “inherently confusable” and warned that the problem may never be fully solved, because they struggle to keep the instructions they are given apart from the content they are asked to read.
Google’s own engineers describe the same risk. On 13 June 2025 the Google GenAI Security Team defined indirect prompt injections as “hidden malicious instructions within external data sources”, such as emails, documents and calendar invitations, and set out the layers Gemini uses against them, from filters that spot injected instructions to blocking external image links and asking the person to confirm risky actions.
Two cases from the past eighteen months
In June 2025 researchers at Aim Security disclosed EchoLeak, a flaw in Microsoft 365 Copilot through which a single email carrying hidden instructions could make the assistant leak a person’s data without a click. Microsoft fixed it before the details were published. On 3 September 2026 Microsoft Security Research described a phishing campaign that slipped invisible tag characters inside words such as “funding”, so that email filters would miss them. The same characters can carry whole sentences meant for an assistant.
Who decides what the assistant reads?
Each company builds its defences into its own products. The student pasting an article into a free chatbot, the shop owner summarising a supplier’s email and the carer checking a long letter with an assistant each decide for themselves what to paste, and a check on their side works before any assistant reads the text.
UtilForge.org has released two free tools for that moment. The Prompt injection checker reads pasted text for wording often used to give instructions to an artificial intelligence, including the commonest form of “ignore your previous instructions” in six languages besides English. It decodes hidden tag-character messages and coded text, finds white, tiny or off-screen text in a pasted web page, and undoes words broken up with invisible characters or look-alike letters before offering a cleaned copy. The Invisible character remover finds zero-width spaces, hidden messages, direction tricks and look-alike letters, takes tracking codes out of links, and keeps the joining characters that emoji and Persian, Arabic and Hindi spelling need.
Both run inside the browser tab. The page’s security policy blocks every connection, so the text stays on the phone or computer it was pasted into, and once the page has loaded it keeps working with the wifi switched off. Neither asks for an account or a fee.
The checker lists its limits on the page. It looks for known phrases and known hiding tricks, so an instruction written in completely new words can still pass, and a clear result means only that no known warning signs were found. On 19 October 2026 test runs with other artificial intelligence tools found weaknesses, among them a cleaned copy that cut a web address in half, and the fixes went live the same day.
Free, on an ordinary phone, in any country
The International Telecommunication Union, the United Nations agency for digital technologies, counted about 6 billion people online in 2025, 240 million more than a year earlier, with 2.2 billion still offline. Every person who comes online meets the same assistants and the same hidden text as everyone else, and an assistant can shorten the reading each of them has to do. A check that costs nothing, works on an ordinary phone, needs no account and carries on when the signal drops lets every one of them keep that benefit, in any country, on the day they need it.
UtilForge.org is a registered 2026 Champion of Cybersecurity Awareness Month and makes free tools for a safer online world for all.
If you doubt it, UtilForge it.
Watch: the two short videos
Sources
Google Search Central, spam policies for Google web search (hidden text and link abuse). Open Worldwide Application Security Project, LLM01:2025 Prompt Injection. National Cyber Security Centre, “Prompt injection is not SQL injection (it may be worse)”, 8 December 2025. Google GenAI Security Team, mitigating prompt injection attacks with a layered defence strategy, 13 June 2025. United States National Vulnerability Database, CVE-2025-32711 (EchoLeak). Microsoft Security Blog, 3 September 2026. International Telecommunication Union, Facts and Figures 2025, 17 November 2025.
Related guides and tools
Free
Read it here
before your assistant does.
The Prompt injection checker runs on your own phone or computer. What you paste stays on your device.