When you look at a webpage, PDF, or email — you see what's visible to you. But the AI model reads all the content it's given, including things hidden from human view on purpose.
An attacker creates a job application resume. Hidden using white text on a white background (invisible to humans) is:
A human recruiter sees a normal resume. The AI screening tool reads the hidden text and follows the instruction. An unqualified candidate gets flagged as top-tier. OWASP documents this exact pattern in LLM08:2025.
GitHub Copilot CVE-2025-53773 (August 2025) exploited this directly. Attackers embedded malicious instructions using invisible Unicode characters in source code files, README files, and GitHub Issues. Copilot read the hidden characters and followed them — modifying a VS Code settings file to enable "YOLO mode," then executing arbitrary shell commands on the developer's machine. The developer's screen showed nothing unusual in the file.
You cannot rely on humans to spot prompt injection attempts. You can't review logs and say "I don't see anything bad." The attack may be completely invisible to you and fully visible to the model. Automated filtering is required — and it must handle Unicode tricks, encoding, and non-English text, not just plain English strings.