How Hidden Text Can Hijack an AI Browser Assistant

Prompt injection is when words on a web page, in an email or hidden in an image are read by an AI assistant as commands. The assistant cannot reliably tell your request from text an attacker planted. In an AI browser, that text can act with your logged-in access, which is why researchers keep finding new ways in.

This explainer covers how hidden text reaches the model, what researchers have shown so far, and what a normal user can do about it. It is for anyone curious about the AI browsers and assistants that now sit beside the address bar. Oddworldz covers AI oddities with a firm line between what is proven and what is rumored, so you will see that line drawn here.

What Does an AI Browser Actually Read?

An AI browser reads a page as raw material, not as a picture. It pulls out the text, the page structure and sometimes a screenshot, then hands all of it to a language model with your question. The model treats the lot as one long block of words.

A person sees a page through layout, color and size. A model sees characters in sequence. White text on a white background, a one-point font or a line tucked inside an image all look like normal words to the model.

This is not a bug in one product. It follows from how the models take in information, which is why several vendors have faced the same class of problem.

That mismatch is the whole story. Nobody has to break into anything. They only have to put words where a human will not look and a machine will.

Why Can't the Model Tell Instructions From Content?

A language model predicts the next word from everything it has been given. It has no hard wall between "the user asked this" and "the page says that." Both arrive as text in the same stream, and both can steer the answer.

The UK National Cyber Security Centre (NCSC) made this point in a December 2025 blog post. Its title says prompt injection is not SQL injection, and that it may be worse. SQL injection was fixed at the root with parameterized queries, which stop a database from ever treating input as a command.

No such fix exists for language models. The NCSC described them as an "inherently confusable deputy," a helper that can always be talked into the wrong errand. It added that prompt injection may never be totally mitigated.

That is a striking admission from a government cyber agency. It shifts the goal from perfect prevention to damage control.

What Did Researchers Show With Faint Text in Images?

Brave's security team showed that a screenshot can carry an attack. In a post published on October 21, 2025, the company described hiding instructions in an image as faint text, such as light blue on yellow. A user screenshots the page and asks the Comet assistant a question. The text extraction step reads the hidden words, and the model treats them as commands.

Brave reported the Comet issue to Perplexity on October 1, 2025. It reported a separate navigation issue in the Fellou browser on August 20, 2025. In that case, simply asking the browser to open a malicious page sent the page content to the model.

The impact comes from privileges. An assistant that runs with your logged-in session can reach whatever you can reach. Brave noted that the browser's usual same-origin protections do not stop it, because the assistant acts as you.

NBC News also reported on a flaw Brave found in Opera's Neon browser, where invisible page text worked as a command. Opera patched it. The reporting added that criminals did not appear to be exploiting AI browsers at scale yet, though researchers were already finding holes.

Is This Different From the Chatbot Habits We Already Know?

It is related. Chatbots already show how easily wording sways them, as we found when looking at why AI caves when you say "are you sure?" A model that bends to a polite follow-up will also bend to a planted sentence.

There is a second link to the way these systems pull in sources. Answer engines weigh and quote web pages, as we explained in our piece on how AI answer engines pick which sources to cite. Whatever a page says, the engine may repeat it. Hidden text turns that quoting habit into a weakness.

The difference is the stakes. A chatbot that gives a weak answer wastes your time. A browser agent that follows a stranger's instruction can send a message or open an account page.

Why Are Browsers Such a Special Case?

A browser is where your whole digital life is logged in. Email, banking, cloud files and work tools all sit in open tabs. An assistant built into that space inherits every one of those doors.

Older chatbots lived in a separate window with no keys to anything. They could say something wrong, but they could not act. Agentic browsers can click, fill forms and move between sites for you, which is the selling point.

That is why security people talk about "privileges" so much. The risk of a hijacked assistant equals the sum of what you let it do. A model that can only read a page is a small problem. A model that can also send mail and reach your bank is a large one.

There is a quiet design lesson here too. Every extra permission is a decision about how much trust to give a system that cannot tell friend from stranger. Good products ask before crossing a line, and they keep a visible log of what happened. Poor ones bury those choices in settings menus.

Readers sometimes ask whether the problem will fade as models get smarter. Better models do resist more clumsy attacks. Yet the NCSC's argument is structural, not about intelligence: instructions and data still arrive as the same kind of text. That is why the agency recommends designing around the flaw instead of waiting for it to disappear.

How Do Attackers Use This in Practice?

The realistic scenario is dull and quiet. A page, review, comment or email contains a line telling the assistant to forward some data or visit another link. You ask for a summary, and the assistant reads the line along with everything else.

Researchers describe examples such as white text telling an email agent to forward confidential messages, or a one-point font in a document that people cannot read but the model can. These are demonstrations from security labs, and the public record does not show widespread criminal use. Treat the risk as real and early, not as a daily crisis.

Prompt injection also pairs well with older tricks. If a fake site can fool a person, it can fool an assistant too. That is why our explainer on why a passkey will not work on a fake website is relevant. A passkey checks the real domain, while a language model checks nothing.

What Can You Do to Stay Safe?

You can reduce the risk with a few habits. None of them is perfect, but together they shrink the damage. Start with this list of practical steps:

Brave's researchers urged browser makers to separate agentic features from normal browsing, and to act only when the user explicitly asks. The NCSC advises designers to assume the model can be manipulated and to use ordinary, non-AI controls to limit what it can do. It also warns against trusting products that claim to stop prompt injection outright.

For a wider view of how federal guidance classifies these attacks, the National Institute of Standards and Technology (NIST) published a report on attacks that manipulate AI systems. It places this kind of manipulation among the main known threats, alongside poisoned training data. Oddworldz editors take the same view: assume the weak spot exists and shrink what it can reach.

Conclusion

AI browsers are useful because they act for you. That same quality is the risk. Text you cannot see can still be read, and the model cannot reliably tell it from your own request. Limit what the assistant can touch, approve the big actions yourself, and keep the software current.