Hidden text on the page contains instructions written for an AI, not a human
This check scans the page source for hidden text, inside an HTML comment or an invisible element, that reads like instructions directed at an AI system rather than at a human visitor. This is a known attack technique called indirect prompt injection. On this site, this kind of hidden AI-directed text was found on the page.
Why this matters
Hidden instruction text may influence AI browsing agents that act for a visitor, or the way AI tools summarise a page, because the agent may read text that human visitors cannot see. This technique is known as indirect prompt injection. It is invisible to people reading the page normally and may not be picked up by conventional security scanners, so it is worth checking for, and removing if unintended. How any particular AI product handles hidden text varies.
How to fix it
Your developer should remove the hidden instruction text from the page source immediately. If this text wasn't put there deliberately by anyone on your team, treat it as a sign the site or a content management system account may have been compromised, and investigate how it got there before assuming it's an isolated issue.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit