The AI security risk that tops every 2026 list
Prompt injection is ranked LLM01 — the number one risk — in OWASP's 2026 Top 10 for LLM applications, with documented attack success rates between 50% and 84% depending on system configuration. In a striking admission, OpenAI stated in December 2025 that prompt injection in AI browsers "may never be fully solved," acknowledging that this isn't a bug awaiting a patch so much as a structural challenge with how large language models process untrusted input alongside trusted instructions.
Indirect injection is the version that matters most
Direct prompt injection — typing "ignore your instructions" straight into a chatbot — is easy to guard against and rarely dangerous on its own. Indirect prompt injection is the pervasive, harder problem: an attacker embeds malicious instructions in content the AI agent will consume as part of a legitimate task — a web page it's asked to summarize, an email it's asked to process, a document it's asked to read — and the model, unable to reliably distinguish "instructions from my user" from "text I'm reading," executes the embedded instructions using whatever access and permissions it currently holds.
The three technical hiding methods that actually work
- Zero-width Unicode characters. Characters like U+200B (zero-width space) or U+FEFF (byte order mark) render as nothing visible, but are still present in the text an AI model processes character by character — letting an attacker splice invisible instructions directly into visible, innocuous-looking content.
- Unicode Tag block steganography. A far more powerful and less well-known technique: the Unicode Tag block (U+E0000–U+E007F) can encode an entire hidden ASCII message that renders as literally nothing when displayed, while an AI model reading the raw text stream can decode and act on it in full.
- CSS/HTML hiding. When an AI agent processes raw HTML (as a browser agent does), text hidden with
display:none, zero font size, matching text-and-background color, oraria-hidden="true"is invisible to a human viewing the rendered page but fully present in the markup the agent parses.
Real-world proof of concept: Comet
Brave's security team demonstrated indirect prompt injection against Perplexity's Comet AI browser by hiding adversarial instructions in invisible page elements, causing the agent to execute sensitive cross-site actions — including fetching one-time passwords and accessing banking portals — using the user's own logged-in session and permissions.
Why this specifically targets AI agents with real access
The danger scales directly with what the AI agent is allowed to do. A chatbot that can only respond with text is a low-stakes target. An AI browser agent, an email assistant with send permissions, or an agent connected to file storage or a company's internal tools turns a successful injection into a genuine action — sending an email, moving a file, or fetching credentials — carried out with the legitimate user's own access.
Why a real scan beats "does this look suspicious"
Zero-width characters and Unicode Tag block steganography are, by definition, invisible to a human reading the text normally — no amount of careful reading catches them, because there is nothing to see. Detecting them requires actually scanning the underlying character codes, which is a deterministic, mechanical check rather than a judgment call, and is exactly the kind of check worth running before handing untrusted content to any AI agent with real permissions.
Where this leaves defense in 2026
In May 2026, the Five Eyes intelligence alliance (CISA, NSA, and international counterparts) issued joint guidance on agentic AI security, naming prompt injection as a core attack vector and explicitly stating that no single safeguard is sufficient on its own. A character-level scan for known hiding techniques is one layer among several — alongside limiting what any AI agent is permitted to do automatically — not a complete solution by itself.
Frequently Asked Questions
That's direct prompt injection, which is comparatively easy to guard against. The harder, more dangerous version is indirect prompt injection: instructions hidden inside content an AI agent is asked to process as part of a legitimate task — a web page, email, or document — which the model struggles to reliably distinguish from its actual instructions.
Two real techniques make this possible: zero-width Unicode characters (like U+200B) that render as nothing visible but are still read character-by-character by an AI model, and Unicode Tag block steganography, which can encode an entire hidden ASCII message that displays as literally nothing while remaining fully readable to a model processing the raw text.
Yes — Brave's security team demonstrated it against Perplexity's Comet AI browser, hiding adversarial instructions in invisible page elements that caused the agent to execute sensitive cross-site actions, including fetching one-time passwords and accessing banking portals, using the logged-in user's own session.
Not according to OpenAI itself, which stated in December 2025 that prompt injection in AI browsers 'may never be fully solved.' The Five Eyes intelligence alliance's May 2026 joint guidance similarly states that no single safeguard is sufficient — detection tools like a hidden-character scan are one layer, best combined with limiting what an AI agent is permitted to do automatically.
No. It performs a real, deterministic scan for known hiding techniques — zero-width characters, Unicode Tag steganography, override phrasing, and CSS hiding — but prompt injection techniques continue to evolve, and a clean scan reduces risk without eliminating it entirely, especially against novel methods not yet catalogued.