Four documented cases, each with a date, a named party and a consequence. Every claim below links to its source so you can check it rather than take our word for it.
In July 2025 Nikkei Asia reported that 17 preprints on arXiv carried hidden instructions aimed at any AI helping to review them — white text on white background, some of it shrunk to near-invisible type. The instructions asked for a positive review and no criticism.
The lead authors were affiliated with 14 institutions across eight countries, including Waseda, KAIST, Peking University, the National University of Singapore, the University of Washington and Columbia. A KAIST professor called the practice unacceptable and one affected paper was withdrawn. Waseda defended it as an answer to reviewers who were themselves using AI. The episode was written up as a paper of its own and covered by Communications of the ACM.
Why it matters here: the reviewers who received those manuscripts could not see the instruction, and neither could the journals. The text was in the file the whole time, and one comparison of the rendered page against the extracted text would have shown all seventeen.
ManpowerGroup, the largest staffing company in the United States, told the New York Times it detects hidden text in roughly 10% of the résumés it scans with AI — on the order of 100,000 a year. The hiring platform Greenhouse, which handles around 300 million résumés annually, puts the rate at about 1% for the first half of 2025. Both figures are reported here.
The two numbers disagree by a factor of ten, and it is worth being honest about why rather than picking the bigger one. They are different populations — one firm's candidate flow against an industry-wide platform — and, more importantly, different detection. A rate is a measure of what a given method catches, not of what is there. Neither company can report the payloads its tooling never noticed.
Why it matters here: whichever number is closer, the practice is not hypothetical and not rare, and the people it is aimed at are exactly the ones who cannot see it.
In June 2025 Aim Security disclosed EchoLeak (CVE-2025-32711), a zero-click flaw in Microsoft 365 Copilot rated CVSS 9.3. The attack was a single ordinary-looking email carrying a hidden instruction — an HTML comment, or white-on-white text. The recipient did not have to open it, click anything or reply.
Copilot read the email as part of its context, followed the instruction, reached into internal files the user had access to, and exfiltrated the contents to an attacker-controlled server. Microsoft fixed it server-side and said there was no exploitation in the wild. It is generally described as the first prompt injection turned into working data exfiltration in a production AI system, and has since been analysed in its own paper.
Why it matters here: the delivery was a document-shaped payload whose instruction was invisible in the client that rendered it. Nothing about the email looked wrong to the person it was sent to.
In May 2025 Legit Security published a remote prompt injection in GitLab Duo, GitLab's AI assistant. A hidden comment placed in a merge request, a commit message, an issue or the source itself was enough to make Duo retrieve a confidential issue the victim had access to, encode it, and smuggle it out inside a rendered image tag.
The payloads were concealed further with Base16 encoding, Unicode smuggling and white-text KaTeX rendering. GitLab patched it after disclosure in February 2025, and it was covered by The Hacker News and CSO Online.
Why it matters here: the attacker never touched the victim's account. They contributed content, which the victim's own tooling then read on their behalf — the same shape as an uploaded document read by your own pipeline.
Three of the four were found by the people looking for them: security researchers and a newspaper investigation. That is worth stating plainly, because it cuts both ways. It means these are not rumours — they have CVE numbers, patches and named institutions. It also means they are the cases somebody went looking for, and the base rate of the ones nobody looked for is unknown by definition.
What they establish together is narrow and solid: the technique works on production systems from Microsoft and GitLab, it is in use at scale in hiring, and it has already cost a researcher a published paper. In every case the concealment was the point, and in every case the person who could have stopped it was looking at a document that appeared completely normal.
Document X-Ray checks for exactly that: it renders each page as published and again with every glyph removed, and reports any text that changed no pixel. It cannot tell you a file is safe. It can tell you what is in it that you were never going to see.
Related: how to find hidden text by hand, prompt injection through documents, and the résumé case in detail.