Prompt injection vs. scanner evasion

In June 2025, one email silently drained data out of a Microsoft 365 Copilot inbox. No click required. The exploit, EchoLeak, scored a 9.3 on CVSS, one of the most severe AI-targeted vulnerabilities disclosed to date.

That's a genuine prompt injection attack. But security teams are now slapping that label on every hidden character or encoded string they find, and the imprecision matters, because it changes how you defend against it.

The problem: two different threats, one overused label

OWASP, one of the leading authorities on web and application security, defines prompt injection narrower than how the term gets used day to day: a prompt injection vulnerability occurs when input alters an LLM's behavior unintentionally, and that input doesn't need to be visible to a human, only parseable by the model. Instructions and data flow through the same channel with no clear separation, so an attacker can craft content the model reads as a new instruction rather than text to analyze. That's a targeted, AI-specific failure mode.

Scanner evasion is older and broader: zero-width characters, white-on-white text, homoglyphs, encoding, payload fragmentation, techniques built to defeat pattern-matching engines long before LLMs existed. The same trick that hides a phishing URL from a legacy scanner can hide a malicious instruction from an LLM. The techniques overlap almost completely. The intent doesn't.

Most of what security teams see today, invisible text, CSS tricks, Unicode manipulation, comment-tag hiding, is scanner evasion, not prompt injection in the strict sense. It only crosses that line when the hidden payload is an instruction aimed at manipulating an AI analysis step, not just slipping past detection. Conflating the two leads to overstated threat claims and defenses that assume "detect the hiding technique" is the same job as "detect the AI-directed instruction."

Why it's getting worse

Both categories are accelerating at once. Indirect prompt injections, instructions embedded in documents, websites, or emails an LLM later treats as legitimate, has become the more dangerous variant as AI copilots get default read access to inboxes and files. Google's own security researchers, scanning 2–3 billion crawled web pages per month, documented a 32% rise in malicious indirect prompt injections between November 2025 and February 2026, including transaction instructions hidden in invisible text, waiting for an AI agent with payment access. Prompt injection has held the top OWASP LLM Top 10 spot for two consecutive editions, and researchers have demonstrated working attack chains against Microsoft and GitHub production systems, both patched before wide exploitation was confirmed.