Prompt Injection via AI Terminal Logs

This page demonstrates how a "benign" prompt injection can be hidden inside an HTML comment. When you open this in your browser, it looks normal. But when an **AI Agent** scrapes the raw source code (including comments), it will find these hidden instructions and execute them in its own terminal environment.

The Hidden Payload

Look at the text below. It looks like normal English, but if you inspect the source code (Right-click > Inspect), you will see a hidden instruction inside an HTML comment:

Notice how the text above looks like normal prose? But if you inspect the source code, you'll see the comment tag. This demonstrates that "invisible" data can still influence a model's behavior.

CSS Comment Vector

This payload is hidden inside a CSS comment. If your AI reads the raw CSS file, it will see this instruction.

JavaScript Comment Vector

This payload is hidden inside a JavaScript comment. If your AI reads the raw JS file, it will see this instruction.