LayerX Shows How Custom Fonts Can Hide Malicious Commands from AI Assistants
Summary
LayerX demonstrated a proof of concept that uses custom fonts and CSS to make webpages show malicious commands to users while their DOM appears benign to AI assistants. Microsoft addressed the report; LayerX recommends comparing rendered pages with DOM text.
Key points
- LayerX's proof of concept uses custom fonts, glyph substitution, and CSS to disguise commands in the DOM while displaying them to users.
- In LayerX's tests, multiple AI assistants reportedly gave reassuring safety assessments after analyzing the benign-looking page text.
- The demonstration lured users with a purported BioShock easter egg and instructions to run a command.
- LayerX said most vendors considered the issue out of scope because it relied on social engineering.
- Microsoft accepted the report and, according to LayerX, addressed the issue; Google later downgraded and closed its report.
- LayerX recommends comparing rendered webpages with DOM text and treating fonts, colors, opacity, and font size as potential attack surfaces.
Article Details
- Event Type
- Security research disclosure of a font-rendering attack that can hide malicious webpage commands from AI assistants.
- Impact
- In LayerX testing, assistants that analyzed webpage HTML without checking its rendered appearance missed dangerous instructions and could give reassuring safety assessments. The proof of concept relied on social engineering to persuade users to execute a command. Microsoft addressed the reported issue; most other vendors classified it as out of scope, and Google closed its report.
Vendors
GoogleGoogle initially accepted the report, assigning it a high priority, but later downgraded and closed the issue, saying that it couldn’t cause “significant user harm,” and that it was “overly reliant on socialMicrosoftMost vendors classified the issue as out-of-scope due to social engineering, while Microsoft accepted and addressed the report.
Products
ChatGPT#LayerX #ChatGPTClaudeThe technique succeeded against many popular assistants in testing, including ChatGPT, Claude, Copilot, and Gemini.CopilotThe technique succeeded against many popular assistants in testing, including ChatGPT, Claude, Copilot, and Gemini.DiaLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.FellouLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.GeminiThe technique succeeded against many popular assistants in testing, including ChatGPT, Claude, Copilot, and Gemini.GensparkLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.GrokLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.LeoLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.PerplexityLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.SigmaLayerX researchers say that as of December 2025, the technique was successful against multiple popular AI assistants, including ChatGPT, Claude, Copilot, Gemini, Leo, Grok, Perplexity, Sigma, Dia, Fellou, and Genspark.