Researchers Demonstrate Hidden Prompt Injection That Turns AI Summaries into ClickFix Lures
Summary
A proof of concept showed that CSS-hidden instructions repeated in HTML could steer tested AI summarizers to present ClickFix steps, including a benign test command. The article describes the technique, risks, limitations, and possible defenses.
Key points
- The technique hides instructions with CSS and HTML methods such as zero-size text, white-on-white text, zero-width characters, and off-screen positioning.
- Repeated hidden payloads, described as “prompt overdose,” are intended to crowd out visible content and steer the summary.
- Tests with Sider.ai and a custom browser extension surfaced the injected ClickFix instructions; results varied, and sometimes included benign page content.
- The proof of concept used a Base64-encoded PowerShell command that the article says was benign for testing, not ransomware.
- The article warns that summaries could make attacker-written instructions appear trustworthy, but does not report real-world deployment of this method.
- Suggested defenses include sanitizing HTML, detecting hidden text and embedded instructions, reducing the influence of repeated content, and warning users about instruction origins.
Article Details
- Attack Vectors
- Hidden HTML instructions use CSS obfuscation—including zero-width characters, white-on-white text, tiny or zero-size fonts, opacity: 0, and off-screen positioning—to influence AI summarizers.
- Repeated hidden instructions (“prompt overdose”) and a separate hidden directive steer summarizers to surface attacker-controlled ClickFix steps.
- Poisoned pages, emails, or documents can be ingested by summarizers in email clients, browser extensions, or productivity tools, which may present the hidden instructions as trusted advice.
- The proof of concept instructed users to open the Windows Run dialog and execute a Base64-encoded PowerShell command. The article says the tested command was benign and intended to simulate ransomware delivery.
- Defensive Notes
- Sanitize incoming HTML by stripping or normalizing suspicious CSS and zero-width characters; flag invisible or near-invisible text before summarization.
- Filter or neutralize embedded instructions and excessive repetition before passing content to a summarizer.
- Detect ClickFix command patterns and analyze encoded commands through decoding and heuristic checks.
- Reduce the influence of repeated or semantically duplicated content during summarization.
- Indicate whether instructions came from hidden or visible source content, and warn or block potentially harmful steps.
- Scan inbound documents and web content for hidden text and directives before ingestion into enterprise AI systems.
MITRE ATT&CK
T1059.001 · PowerShellThe proof of concept surfaced a Base64-encoded PowerShell command for execution; the article says the tested command was benign.T1204.004 · Malicious Copy and PasteThe proof of concept's summarizer output tells the user to copy a command, open the Windows Run dialog, paste it, and press Enter.