Why your AI obeys text you can’t see
A hidden line on a page reaches your AI together with your question, and it can’t reliably tell which one is the instruction.
Plays from YouTube when you tap
- File
- DA-C002
- Published
- 7 Oct 2026
- Runtime
- 1:21
- Sources
- 04
- The detail nobody notices
- Your AI reads the text of a page, not what you see on the screen.
What’s really happening.
- 01
Ask an AI to summarise a web page and it reads the page’s text, not the picture you see. A line in white text on a white background is invisible to you and perfectly readable to it.
- 02
This is not a theory. In 2025, reporters found seventeen research papers hiding a line like that, telling AI reviewers to give a positive review only.
- 03
Your question and the page are joined into one block of text, and the model has no reliable way to tell your instruction from the content. That is called prompt injection.
- Name
- Prompt injection: LLM01 in the OWASP Top 10 for LLM applications (2025).
- Channel
- Instructions and content share one stream of tokens. To the model there is no separate “data” lane.
- Visibility
- Injected text can work even when it is imperceptible to people: white-on-white, tiny fonts.
- Evidence
- Nikkei Asia, 1 July 2025: 17 papers, 14 institutions, 8 countries, with hidden “give a positive review only” prompts.
- Risk
- Highest when the AI can act for you: read mail, open files, call tools.
The technical layer of this case is behind Agent Mode.
If your AI can act for you, make it ask before it acts on a page you don’t trust, and keep private data out of its reach.
Checked against the source.
- [1]OWASP GenAI Security ProjectLLM01:2025 Prompt Injection The name; injected input can work even when imperceptible to people; sensitive-data disclosure as an impact.
- [2]Nikkei Asia · 1 July 2025“Positive review only”: researchers hide AI prompts in papers Seventeen papers with hidden prompts telling AI reviewers to give a positive review only.
- [3]UK National Cyber Security CentrePrompt injection is not SQL injection A language model makes no distinction between data and instructions.
- [4]Anthropic · Claude docsComputer use tool Ask a human to confirm consequential actions; keep sensitive data away from the model.
Transcript
- Your AI can take orders from one line of text you can’t see, and it could cost you your private data. Why does it obey?
- Let’s decode it.
- Say you ask your AI to summarise a web page. It looks normal, but it contains one line in white text on a white background. You can’t see it. Your AI can, because it reads the text of the page, not what you see on the screen.
- This is not a theory. In 2025, reporters found seventeen research papers hiding a line like that, telling AI reviewers to give a positive review only.
- So why does the AI follow it? It is not a bug in one tool. Your question and the page are joined into one block of text, and the model has no reliable way to tell your instruction from the content. That is called prompt injection.
- It matters most when your AI can act for you. So make it ask you before it acts on a page you don’t trust, and keep your private data out of its reach.
- You now know why your AI obeys text you can’t see. Join the Decode Agent journey, and decode the next case with me.
No corrections since publication. If a fact changes, it’s logged here.
You already see what others miss_
Claim your Agent ID and follow the journey from the inside. Decode Agent is just getting started.
- Your Agent ID, yours to keep and share.
- Every case, filed here with its sources.
- On the list when updates begin.
