Invisibility is a property of the renderer, not of the bytes. A summarize-this-URL path normally goes fetch, strip tags, feed text to the model. Nothing in that sequence evaluates the rule that paints a character white on a white ground, and nothing weighs a zero-width space at zero. The hidden string lands in the context window with the same standing as the `<h1>`. Your extractor is more thorough than your users, which is the whole exploit.
Forcepoint's account of the CSS-based variant is that the model reads those embedded strings as part of its instructions and returns a summary carrying encoded links or fragments of executable text [8]. The post's own one-line version is blunter: "if an AI can read everything, it can also be deceived by anything" [15].
One page, two readers. On the Booking.com impersonation X-Labs walks through, hidden JavaScript collected data and staged an obfuscated downloader and credential stealer once the victim finished the on-screen steps [12], while Forcepoint reads the invisible layer of such pages as aimed at summarizers or automated scanners reviewing the same content [13]. Earlier ClickFix, including the Odyssey Stealer macOS work X-Labs published, needed a person to paste [14]; the CSS variant adds a reader that executes nothing and still shapes what the person is told.
Two claims in the post carry different weight. Three distinct payload families turn up in the early samples [16], which suggests the invisible-prompt trick is circulating between operators rather than sitting in one crew's toolkit. The geography is softer. Forcepoint reads bursts in North America, Western Europe and Southeast Asia as tracking the regions with highest enterprise AI adoption [6]. For that to transfer to your own risk model, sensor coverage would have to be roughly even across those regions and across the ones that stayed dark. Vendor telemetry maps the install base before it maps the adversary.
Adoption cost. Render first and then extract, and you get visibility-aware text at the price of a headless browser per fetch, which is real latency and real CPU on every page an agent reads. Normalizing text at ingest is far cheaper, but put the strip behind a flag and log what you removed, so the day someone's non-Latin content loses characters you can find out why rather than guess. The part I would not trade is authority. Text that arrived over a fetch is data, a summary of that text is also data, and nothing in either should become a tool call, a click target or a clipboard write without a human in between.
In my context that puts the trust boundary at the fetch. The config line that proves you meant it is the one that records what your extractor threw away.
