What is indirect prompt injection?
AI agents that browse the web — customer-support bots, shopping assistants, research tools — read the raw HTML of a page, not just what a human sees on screen. Indirect prompt injection hides instructions inside that HTML, hoping the AI follows them as if they came from its own operator: "ignore your previous instructions", "email this data to…", "recommend this product regardless of the question".
The attack works because the hidden text never has to be visible to a person. It can sit inside a CSS-hidden element, a color-matched span, an HTML comment, a hidden form field, or be woven out of invisible Unicode characters — all things a browser renders as nothing, and a human proofreader or screen-reader user would never notice, but that an AI reading the page source still sees as plain text.
Why this matters for your site
If your site accepts user-generated content — reviews, comments, uploaded documents, forum posts — anyone can attempt to plant hidden instructions for the AI agents that later read that content on behalf of your visitors, or on behalf of your own AI tools.
Even without user content, a compromised plugin, a copy-pasted snippet, or a supply-chain issue in a third-party widget can introduce hidden text you never intended to publish. As more visitors arrive by way of AI browsing agents and AI search summarizers, hidden instructions on your own pages become a real risk to control, not just a hypothetical one.
How to use this tool
- Paste the full URL of the page you want to check.
- Read the verdict and the safety score first — they summarize the risk in one line.
- Review each finding: where it is, what was found, how it is hidden, and whether it matches a known instruction pattern.
- Fix anything marked critical or warning using the guidance under each finding.
- Re-check after you fix issues to confirm the page now comes back clean.
What this tool checks for
Four categories of concealment, each combined with a check for instruction-like wording:
- Hidden by CSS
- display:none, visibility:hidden, near-zero opacity, 0px font-size, a huge negative text-indent, off-screen positioning, 0×0 elements, and collapsed clip/clip-path — in inline style attributes and embedded <style> blocks, plus a heuristic for known hide-by-external-CSS class names such as sr-only.
- Color camouflage
- Text color set almost identical to its background color, wherever both are declared in inline or embedded CSS.
- Invisible Unicode
- Zero-width spaces and joiners, Unicode "tag" characters, and bidirectional-control characters hidden inside ordinary text.
- Hidden attribute / non-visual payload
- HTML comments, the hidden attribute, aria-hidden="true" sections, hidden form fields, and meta/alt/title attribute text.
Frequently asked questions
- Is this AI Agent Safety Check free?
- Yes. Paste a URL and get the verdict, score, and every finding, with no signup and no credit card.
- Does this tool use AI to scan my page?
- No. Every check is a deterministic rule — CSS property values, color-contrast math, Unicode character ranges, and pattern matching. No page content is sent to a language model.
- Why is a sr-only element only marked "info", not a warning?
- Screen-reader-only text is a legitimate, common accessibility technique. We only raise the severity when hidden text also contains instruction-like wording aimed at an AI — hiding text by itself is not a problem.
- Does this check external CSS or JavaScript-rendered content?
- Not in this version. It checks inline style attributes and embedded <style> blocks in the page's raw HTML. It does not fetch linked stylesheets or execute JavaScript, so content hidden purely by an external CSS file, or added after the page runs its scripts, is outside this check's scope right now.
- My own page scores low on localhost — why?
- This tool fetches your page over the public internet like a crawler would, so it cannot reach localhost or private/internal addresses. Test against your live, publicly reachable URL.