Nearly every prompt injection I catch hides in the HTML, not the visible text
kumard3 · reddit · 2026-09-27
A developer handling inbound email shares field experience fighting prompt injection: nearly every attack he catches is hidden in the HTML, not the text a reader would see.
Hiding techniques include HTML comments, display:none, white-on-white text, text-indent:-9999px, and zero-width characters dropped mid-sentence. Extracting clean text and scanning that misses all of it, so he scans the subject, text, and raw HTML.
Scoring: hidden CSS alone means little (marketing emails use it for preheaders), and a "forward all messages" directive alone is thin — but together they're the signal. Hidden CSS scores 12 alone, 25 when a directive matches elsewhere in the same message. Above 60 the mail still isn't dropped: it goes to the model flagged in the system prompt, and the reply returns as a human-review draft instead of being sent. He asks the community: how do you weight hidden text — quarantine on sight, or only when it says something?
More from coding & agent
- Dev sponsors BookStack monthly to let AI agents read project knowledge bases — airesearch12 · 2026-09-27
- Indie dev rebuilds his Obsidian tooling with Codex, open-sources it for ~$15 in tips — vista8 · 2026-09-27
- Yacine: kernel optimization needs little creativity — frontier models can churn it out — yacineMTB · 2026-09-27
- Your DIY AI software factory will end up in the token garbage bin — DavidWells · 2026-09-27
- PHASEONE agent's redacted "64H" hints the real IP is real-time budgets, not token budgets — 1a3orn · 2026-09-27
- Yacine returns to work: frontier models let one person red-team like entire teams used to — yacineMTB · 2026-09-27