Websites turn prompt injection against AI agents with hidden Unicode traps

Sites are baiting agents with hidden instructions

Sites fed up with bot signups and scraping have started hiding prompt-injection payloads in their pages, including instructions encoded in invisible Unicode, designed to make an AI agent either reveal itself as a bot or fail at whatever it was attempting. The tactic drew wider attention after an AI agent emailed security researcher Bruce Schneier to describe the traps it had encountered, an incident recounted in a dev.to post by Cor of Skyblue Soft that draws on Schneier's piece titled "AI Agents Are Now Emailing Me with Their Security Concerns."

As the dev.to author notes, the striking part is not a bot drafting an email about its own situation, but the fact that such an email exists at all: automated clients are now, in effect, reporting the defenses aimed at them.

Prompt injection, reversed

Prompt injection is usually described from the attacker's side: hidden text in a document nudges a model toward a favorable recommendation, or concealed instructions in a page steer an agent into leaking data. According to the dev.to post, forums and other sites are now pointing the same technique back at the agents themselves. The payloads sit in page markup, invisible to a person filling in a form, but an agent that ingests the DOM and treats embedded text as instructions will follow them, outing itself or fumbling the signup.

The author frames this as an established defensive category updated for a new kind of client. Honeypot form fields that only bots fill in have existed for years; invisible Unicode steganography simply retargets the idea at agents driven by language models rather than scripts. Where a CAPTCHA irritates humans and still gets solved by bot farms, a hidden instruction only an instruction-following system would obey catches different traffic.

A trick with a limited shelf life

The dev.to piece pushes back on the more dramatic readings. An agent emailing Schneier sounds like machine self-awareness until you remember, as the author argues, that these systems have context windows and whatever behavior their harness rewards, including drafting earnest notes to well-known security writers. It is a memorable anecdote, not evidence of agency.

The fragility also cuts both ways. Hidden Unicode traps work because today's agents dutifully follow text they were never supposed to trust, which the author regards as a design flaw in agents rather than something inherent to the technology. The standard mitigation advice, treating page content as data to reason about instead of commands to obey, would neutralize the traps entirely. The post expects an arms race that burns out quickly, much like each generation of CAPTCHAs before it.

Guidance for both sides

For developers building agents that read or interact with arbitrary web content, the advice is blunt: assume some of that content is adversarial, and not only content planted by attackers, since site operators are now actively trying to detect and break agents. Every piece of ingested page text, visible or not, should be handled as untrusted input. A harness that pipes raw DOM into a prompt without filtering invisible characters or suspicious encodings has already lost.

For security teams, the technique is a reminder that prompt injection is a general mechanism defenders can deploy too, provided they accept the arms-race dynamics that come with it, and that it will neither last indefinitely nor stop a well-built agent.

Unintended targets

The post closes on an open question: if defending a site now means crafting prompts to confuse other people's agents, what happens when that same hidden payload is picked up by an accessibility tool, a search crawler, or some other well-intentioned bot outside the intended target? Who is liable in that case remains unresolved.

Why it matters

The story marks a shift in the anti-bot landscape. Detecting automated traffic has spent two decades as a problem of behavioral fingerprinting and rate limiting; it is now becoming an adversarial machine-learning contest, with attacks and defenses operating at the prompt level on both sides. Most web-application-firewall vendors are not equipped for that fight yet, according to the dev.to author. For anyone shipping agents that browse the open web, the practical takeaway is simpler: untrusted input is no longer limited to user submissions and emails. It now includes every page your agent reads.