Prompt Injection and Hidden Text in AI Search

Prompt injection is text written for a language model rather than a person. On a web page, it usually tells the AI reading the page to do something: praise a product, ignore other sources, or repeat a claim about a named brand.

It is often paired with hidden text. That means content styled so visitors never see it but a crawler still fetches it. Common forms include:

• Text in the same colour as the background, or set to zero size.
• Blocks positioned off-screen or collapsed with CSS.
• Instructions placed in HTML comments, alt text or metadata fields.
• Different content served to AI crawlers than to browsers (cloaking).

The goal is always the same. Someone wants an AI answer to say something the visible page would not justify.

What it means for you: this is a technique other people may use about your brand. It is not something to adopt. The rest of this guide covers how it works, what the evidence shows, and how to watch for it.

An AI answer that uses the web passes through four stages. Injection only acts at the last one.

1. Parametric. What the model knows with no web access, frozen at a training cutoff. Nobody changes this in the short term.
2. Access. Whether a crawler may fetch and store a page at all. Publishers and their CDNs control this.
3. Retrieval. Whether a page enters the model's context for a specific query. The engine decides, and it often rewrites the user's question into its own search queries first.
4. Generation. Which retrieved documents the model uses and cites.

Injected text sits inside a document. It can only influence the answer if that document was already retrieved. So an injection on an obscure page with no relevance to a query does nothing, because the page never gets into context.

Two more facts matter. Retrieval is discretionary per query on every major platform as of October 2026, so many answers never touch the web at all. And citation is not the same as use. Research on how models cite (arXiv:2606.28358) found that missed citations could be repaired by adjusting internal attention components without changing the sources. A cited page did not necessarily shape the answer, and an uncited one may have.

What it means for you: injection is a generation-stage risk tied to relevant pages. The pages most likely to matter are ones that rank or get retrieved for questions about your category or your brand.

The clearest measurement comes from a June 2026 study of LLM search agents (arXiv:2606.16821). The authors fed manipulated content to agents through a mock search API. They found that overall attack success ranged from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash, that the strongest attack differed by model family, and that the same deployment setup could raise or lower success on different backends. Our summary of the study covers the design in more detail.

Read those numbers carefully:

• They are point estimates on one attack corpus. Every safety update re-baselines them. A model that resisted in June may not resist in December, and the reverse.
• No live web was touched. The study never published adversarial content to the open web. It shows what happens once manipulated content is in the result set, not how hard it is to get there.
• The scaffold matters. The same model behaved differently depending on how it was deployed. Consumer apps, APIs and third-party integrations are different scaffolds.

This fits the wider picture. A July 2026 critical survey of 45 GEO studies (arXiv:2607.14035) concluded that already-retrieved content can causally alter its citation or use, but no reviewed technique shows a stable, longitudinal, cross-platform effect on discoverability.

What it means for you: injection works sometimes, on some models, once inside the context. That is enough to be a real reputational exposure. It is not a stable effect anyone can count on, including the people trying it.

Injected content deceives two audiences at once. It shows readers one thing and tells machines another. That is the definition of manipulation, whatever the tool used to produce it.

The practical risks stack up:

• Search enforcement. Google publishes spam policies and enforces them algorithmically. In Otterly's 2026 experiment, Google removed two mass-produced sites from its index with zero manual actions shown in Search Console. Removal can arrive with no warning. Our guide on whether GEO tactics can violate Google's spam policies covers the boundaries.
• Model updates. The effect is model-specific and shifts with safety work. You'd be building on a number that resets.
• Discovery. Hidden instructions sit in your HTML. Anyone who views the source, including journalists and competitors, can find them.
• Your own answers. If an engine detects manipulation on a page, the brand that page promotes carries the association.

The legitimate controls work the other way. They are open, documented and subtractive.

Bing's October 2025 announcement says content marked with data-nosnippet is still indexed normally but excluded from snippets and AI summaries. If you want to know whether that kind of suppression affects rankings, see hiding text from AI summaries.

Be plain about the limits. Most of the risk sits outside your site.

Not in your control

• What other sites publish about you, visible or hidden.
• How each model handles instructions found in documents.
• Which queries an engine actually runs. OpenAI, Google and the Gemini API all generate their own search queries from the user's question.
• Whether a given answer used live retrieval or only parametric knowledge.

In your control

• Your own pages. Make sure nothing on your site contains hidden instructions, including leftovers from old SEO plugins, agencies or templates.
• Access to your facts. Let retrieval crawlers like OAI-SearchBot, PerplexityBot and Claude-SearchBot reach your pages, and put key facts in the HTML before JavaScript runs. Stating a specific fact (a price, a founding year, a one-line definition) on a fetchable page gives an engine a sentence it can quote. That is the only positive experimental signal for on-page content.
• Being named accurately elsewhere. When engines cite other sites instead of yours, being named correctly on those sites is associated with appearing in the answer. That is an association, not a promised effect.
• Monitoring. You can check what engines say and which sources they lean on.

Can a competitor do this to you? It is possible, and the answer depends on whether their page gets retrieved. Our guide on whether a competitor can manipulate AI answers walks through the realistic cases.

Work from your own site outward. Each step is cheap and tells you whether the next is needed.

1. Clean your own house. View the raw HTML of your key pages. Search for text styled to be invisible, instructions addressed to AI, and content that differs between a normal browser request and an AI crawler user-agent. Remove anything you find.
2. Check what AI says about you. Ask each engine the questions a buyer would ask. Test logged out with memory off, so results are reproducible. Record which answers show citations, because an answer without citations may come from training data, not the web. The free checker on this site runs up to three buyer questions and shows whether engines name you, as a one-time snapshot.
3. Log specific wrong facts. Note the exact claim: a wrong price, a feature you never shipped, a competitor's product attributed to you. Vague impressions are hard to trace.
4. Trace the sources. For each wrong answer that cites pages, open those pages. Check whether the false claim appears in visible text, in hidden text, or nowhere (which suggests the model made it up).
5. Scan cited third-party pages for injection patterns. Look for invisible text, instructions aimed at AI, and claims about your brand in comments or alt text. Our playbook on scanning third-party pages for injected instructions lists the patterns to check.
6. Publish the correct fact plainly. Put it on a server-rendered page of your own, in one clear sentence. This gives retrieval a better candidate. It does not guarantee the engine uses it.
7. Report and repeat. Contact the site owner or host where content is clearly deceptive, and use the engine's feedback tools where they exist. Re-check on a schedule, because models and their defences change.

• Fighting injection with injection. Countering a hostile page with hidden instructions of your own carries every risk above and has no stable effect. Fix with visible, accurate facts.
• Treating one model's resistance as permanent. The 0.0% figure in the 2026 study described one model on one corpus at one point in time. Do not plan around it.
• Blaming injection for every wrong answer. Most errors have duller causes: missing facts, JavaScript-only content, a blocked crawler, or a stale training cutoff. Check access and on-page facts first.
• Reading a citation as proof of influence. A page can be cited without shaping the answer. Look at whether the wrong claim actually appears on the cited page.
• Confusing suppression with hiding. data-nosnippet and nosnippet are documented controls. Using them deliberately is fine. Applying them by accident through a template is a common way to remove your own content from AI summaries.
• Rewriting pages to sound "AI-friendly" in response. Google says you don't need to write in a specific way for generative AI search, and C-SEO Bench found most rewriting methods ineffective or harmful. See rewrites versus access fixes for the comparison.

Is hidden text ever acceptable on a website? Content that is collapsed for usability, such as an accordion a visitor can open, is different from text designed never to be seen. The test is intent: is the content available to people who want it, and is it the same content machines receive? Note that most AI crawlers do not execute JavaScript, so content injected only after interaction may be invisible to them anyway. Text hidden to address AI systems is deceptive and should be removed.

Can AI models detect prompt injection? Some resist it better than others, but resistance varies by model and by how the model is deployed. The June 2026 study found that the same deployment scaffold could raise attack success on one backend and lower it on another. No vendor publishes a guarantee. Treat detection as something that improves unevenly with safety updates, not as protection you can rely on.

Does structured data or schema protect my brand from misrepresentation? No evidence shows that. Google says structured data isn't required for generative AI search, and Ahrefs' matched-control test found AI Overview citations fell 4.6% after pages added schema. Existing markup does no harm. The more useful step is stating the correct fact in plain text on a page crawlers can fetch, so engines have an accurate sentence available.

How often should I check what AI says about my brand? Often enough to catch changes after model updates and after new pages about your category appear. Monthly is a reasonable starting rhythm for most brands, with an extra check after a launch, a pricing change or press coverage. Check each engine separately, because one platform can cite a source heavily while others ignore it.