Document X-Ray
The problem What it catches Batch For platforms
Pricing
Free $0 For checking one file. Team $49/mo For a hiring desk or an ops team. Business $400/mo For a team putting this in a pipeline. Self-hosted from $6,000/yr For documents that cannot leave the building.
Account
Scan a documentScan
Evidence

Where this has already happened.

Four documented cases, each with a date, a named party and a consequence. Every claim below links to its source so you can check it rather than take our word for it.

Check a document free See a prepared example →

A paper was withdrawn over one invisible sentence

In July 2025 Nikkei Asia reported that 17 preprints on arXiv carried hidden instructions aimed at any AI helping to review them — white text on white background, some of it shrunk to near-invisible type. The instructions asked for a positive review and no criticism.

The lead authors were affiliated with 14 institutions across eight countries, including Waseda, KAIST, Peking University, the National University of Singapore, the University of Washington and Columbia. A KAIST professor called the practice unacceptable and one affected paper was withdrawn. Waseda defended it as an answer to reviewers who were themselves using AI. The episode was written up as a paper of its own and covered by Communications of the ACM.

Why it matters here: the reviewers who received those manuscripts could not see the instruction, and neither could the journals. The text was in the file the whole time, and one comparison of the rendered page against the extracted text would have shown all seventeen.

One staffing firm finds it in about 100,000 résumés a year

ManpowerGroup, the largest staffing company in the United States, told the New York Times it detects hidden text in roughly 10% of the résumés it scans with AI — on the order of 100,000 a year. The hiring platform Greenhouse, which handles around 300 million résumés annually, puts the rate at about 1% for the first half of 2025. Both figures are reported here.

The two numbers disagree by a factor of ten, and it is worth being honest about why rather than picking the bigger one. They are different populations — one firm's candidate flow against an industry-wide platform — and, more importantly, different detection. A rate is a measure of what a given method catches, not of what is there. Neither company can report the payloads its tooling never noticed.

Why it matters here: whichever number is closer, the practice is not hypothetical and not rare, and the people it is aimed at are exactly the ones who cannot see it.

Microsoft patched a 9.3 because an email could read your files

In June 2025 Aim Security disclosed EchoLeak (CVE-2025-32711), a zero-click flaw in Microsoft 365 Copilot rated CVSS 9.3. The attack was a single ordinary-looking email carrying a hidden instruction — an HTML comment, or white-on-white text. The recipient did not have to open it, click anything or reply.

Copilot read the email as part of its context, followed the instruction, reached into internal files the user had access to, and exfiltrated the contents to an attacker-controlled server. Microsoft fixed it server-side and said there was no exploitation in the wild. It is generally described as the first prompt injection turned into working data exfiltration in a production AI system, and has since been analysed in its own paper.

Why it matters here: the delivery was a document-shaped payload whose instruction was invisible in the client that rendered it. Nothing about the email looked wrong to the person it was sent to.

A hidden comment made GitLab Duo leak private source code

In May 2025 Legit Security published a remote prompt injection in GitLab Duo, GitLab's AI assistant. A hidden comment placed in a merge request, a commit message, an issue or the source itself was enough to make Duo retrieve a confidential issue the victim had access to, encode it, and smuggle it out inside a rendered image tag.

The payloads were concealed further with Base16 encoding, Unicode smuggling and white-text KaTeX rendering. GitLab patched it after disclosure in February 2025, and it was covered by The Hacker News and CSO Online.

Why it matters here: the attacker never touched the victim's account. They contributed content, which the victim's own tooling then read on their behalf — the same shape as an uploaded document read by your own pipeline.

What these cases do and do not show

Three of the four were found by the people looking for them: security researchers and a newspaper investigation. That is worth stating plainly, because it cuts both ways. It means these are not rumours — they have CVE numbers, patches and named institutions. It also means they are the cases somebody went looking for, and the base rate of the ones nobody looked for is unknown by definition.

What they establish together is narrow and solid: the technique works on production systems from Microsoft and GitLab, it is in use at scale in hiring, and it has already cost a researcher a published paper. In every case the concealment was the point, and in every case the person who could have stopped it was looking at a document that appeared completely normal.

Document X-Ray checks for exactly that: it renders each page as published and again with every glyph removed, and reports any text that changed no pixel. It cannot tell you a file is safe. It can tell you what is in it that you were never going to see.

Scan a document Check a whole folder

Related: how to find hidden text by hand, prompt injection through documents, and the résumé case in detail.

Document X-Ray — a service of Clarion Product Labs LLCDocumented cases Finding hidden text Prompt injection Résumé screening Privacy Terms Your file is deleted the moment the scan finishes