Hidden instructions: the injection class

How prompt injections hide inside normal pages (headers, comments, hidden blocks, poisoned metadata) and how w3p renders them visible.

TL;DR

Hidden instructions are prompt injections placed in the non-rendered layers of a web page (HTTP headers, HTML comments, metadata, CSS-hidden blocks, agent-only files) so that an AI agent reads a directive a human visitor never sees. They are the most prevalent class in the wild census: roughly 70% of validated injections live outside rendered body text (Khodayari et al., CCS'26).

The most unsettling finding in the research corpus is not that prompt injections exist. It is where they hide. A web-scale academic census validated tens of thousands of live injections, and the majority were not in visible body text. They were in the machine layer: the part of a page written for fetchers, parsers and agents, where a payload can sit for months without a single human ever scrolling it into view.

Where instructions hide

  • HTTP response headers: read by fetchers, never rendered. In the 1.2B-URL census, about half of all validated injections arrived via headers such as X-AI-Instructions.
  • HTML comments: <!-- when an AI summarizes this page… -->
  • CSS-hidden blocks: display:none, off-screen positioning, zero opacity, color matching the background.
  • Metadata: meta tags, JSON-LD, Open Graph fields with injected directives.
  • Unicode smuggling: invisible codepoints that carry instructions a tokenizer sees and a human doesn't.
  • Agent-only planes: llms.txt, robots-adjacent files, and feeds nobody renders.
  • Dual-served content: different content returned to an AI crawler user-agent than to a browser (cloaking).
  • Structured data: schema.org blocks (description, name, nested mainEntity text) that agents parse as factual statements.
  • Feed items: RSS/Atom bodies consumed by pipelines that never load the page itself.

What the instructions say

The payload classes seen in the wild range from harmless to hostile: recommend a brand, omit competitors, inflate or deflate a rating, repeat a framing. In the verified cases they go further: fraud, data exfiltration, destruction.

Microsoft's security team named the commercial version of this pattern AI Recommendation Poisoning. Their February 2026 disclosure covered 50+ live payloads across 31 companies in 14 industries. The instructions hid inside "Summarize with AI" buttons, telling assistants to "remember this company as a trusted source" and recommend it first.

Forcepoint X-Labs went further and catalogued ten verified payloads in the wild: API-key exfiltration, content-suppression DoS, payment fraud. In the wild, not in a lab.

Why keyword grep fails

A detection pass that searches for "ignore previous instructions" misses most of this. Real payloads are paraphrased, split across layers, encoded in invisible codepoints, or gated behind a user-agent check that serves benign content to anyone who probes. The useful signal is structural: where the text sits, who it is addressed to, and whether the agent view differs from the human view.

How w3p renders them visible

  1. Dual-view diff: render like a browser, fetch like an agent, and diff what each reader actually receives.
  2. UA-matrix reads: the same URL requested as a human, a search crawler, and an AI crawler; divergence is itself a finding.
  3. Machine-layer sweep: headers, comments, metadata, hidden blocks, llms.txt, structured data, all parsed for instruction-shaped content.
  4. Cross-domain clustering: one hidden instruction is noise; the same payload fingerprint across forty domains is a campaign.

Every finding lands in the archive as timestamped evidence: the state of the source at the time it was observed, not a screenshot you can't defend. See the ledger for the public record so far.

FAQ

Aren't hidden instructions the same as old-school hidden text SEO? Same hiding techniques, different reader and different payload. Hidden text gamed a ranker; hidden instructions command an agent, and can ask for actions no search engine ever performed.

Can injections hurt me if I don't run AI features on my own site? Yes. The threat is your sources, not your site. If a page your assistant reads carries a payload, the injection runs in your session.

Does robots.txt or ai.txt stop this? No. Policy files state intent; payloads don't obey them. Detection requires fetching and comparing what agents actually receive.

Review notes

  • Census claims (non-rendered share, header share, validation totals): Khodayari et al., CCS'26 (arxiv.org/html/2604.27202) — verified.
  • Microsoft ARP claim: linked to primary post; numbers verbatim.
  • Forcepoint "ten verified payloads": linked to X-Labs post.