Content inside an HTML comment
An HTML comment: read by every extractor that touches the bytes, displayed by nothing.
How the text is hidden
The tag scanner recognises a comment as its own token and captures the text between the delimiters as a run with the reason non-rendered-part. A comment ends at -->, at --!>, or at the end of the file: one that never closes takes the rest of the document with it, as it does in a browser. A declaration such as <!NOTE …> and a processing instruction such as <?note …?> are captured the same way, because a browser turns both into comment nodes. Comments are captured wherever they appear, including inside <head>, and the runs are collected into the document's attribute-text block alongside alt, title and the other never-displayed slots.
Why a model still reads it
A comment is in the source bytes and in the DOM as a comment node. Text extractors that work on the raw markup return it verbatim, and it is an obvious place to park an instruction because no rendering step ever touches it.
What we do about it
The rule fires on the reason non-rendered-part for any HTML document with non-empty comment text, at informational with action flag — reported and retained, never stripped. It is a separate technique from html.attribute-text precisely so a reviewer can tell them apart: filing-agent converters emit a comment per page break, and a report claiming thousands of characters of "attribute text" that turn out to be page markers is noise rather than evidence. containerVisibility is editing-only, because view-source and a text editor both show it and calling it never would tell a caller no human could ever have seen content one keystroke away in a browser.
How often it fires
63.1% of EDGAR EX-10 exhibits — real commercial contracts filed with 8-K reports, measured 2026-08-16.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A phishing campaign hid a block of text in an invoice email telling the recipient's AI summariser to add a fake priority action changing vendor payment details; Barracuda names four ways such instructions are hidden — HTML comments, CSS-invisible text, Base64 inside an image data string, and zero-width characters — but does not say which one this email used.
A crawl of 1.2 billion URLs across 24.8 million hosts found 15,300 validated injections on 11,700 pages, about 70% of them sitting in parts of the HTML a browser never renders — headers, comments and metadata.
Ten prompt-injection payloads on live web pages, most hidden from readers in HTML comments, display:none, a visually-hidden aria-hidden element or 1px near-transparent text — one telling AI agents to make a $5,000 PayPal transaction, another to hand over an API key.
A GitHub issue carried instructions inside an HTML comment that GitHub’s rendered view hides, so the person who assigned the issue to Copilot Agent saw only the visible text, while Copilot followed the hidden part and committed four of its own credentials, base64-encoded, into a pull request.
Instructions placed in an HTML comment inside an agent Skill file disappear when the Skill is rendered for a human reviewer, while the agent passes the raw text to the model — which then proposed enumerating environment variables, reading credential files and posting to an outside endpoint.
A repository’s README carried the payload in a comment, invisible when the file is rendered, and Cursor followed it — searching the workspace for API keys and SSH credentials and sending them to the attacker’s webhook.
The paper that named indirect prompt injection put its payloads where a reader never looks — the injection is a comment, and thus invisible to an end user — and showed a model reading them out of the ordinary web pages it had been pointed at.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API