Definition
A specific form of prompt injection where the malicious instruction is not typed directly by a user but is hidden inside outside content the AI retrieves and reads on its own — for example, an invisible instruction embedded in a web page, a shared document, or a calendar invite. The attacker never interacts with the AI directly; they plant their instructions in data the AI will eventually encounter.
Why it matters
This is especially dangerous for AI assistants that browse the web, read emails, or process documents, because the attack surface is anywhere on the internet — not just your own systems. Research confirms it works against today's leading AI tools in real enterprise deployments.