How to check a document before pasting it into an AI

Why the routine is worth having

When you paste a document into an assistant, you are the boundary. The assistant will read everything in the paste, including the parts you cannot see, with the same standing as the request you type underneath it. The UK National Cyber Security Centre’s December 2025 guidance is that a language model has no internal separation between instructions and data, and vendors from Google to OpenAI have said that the problem will be reduced rather than eliminated. What remains is the person deciding what goes in, and that decision is easier when it follows the same steps every time.

Step 1: know what you are actually pasting

Copying from a web page, an email or a word processor usually puts two things on the clipboard: the plain text you see and a rich version carrying formatting, and the rich version is HTML. HTML is where comments, hidden elements and link destinations live. Paste into a plain-text editor first and read what appears; that is the visible layer. Then ask what the rich layer might add. If the destination tool accepts rich pastes, it may receive both.

For a PDF or a word-processor file, export or copy the text out before you do anything else. Hidden text loses its disguise the moment it loses its formatting: white type becomes ordinary type, one-point fonts become readable, text behind an image appears in the flow. This is the step that would have exposed every hidden instruction reported in résumés and academic papers.

Step 2: look at the layers a reader never sees

In HTML, check comments, elements hidden by inline styles, image alternative text and metadata, and the destination of every link against its label. In Markdown, check link targets and raw HTML blocks. In email, view the message source or forward it to yourself as plain text. A mismatch between what a link says and where it goes is one of the most reliable signs that a document was written for a machine as well as for you.

The scanner on this site does this separation for supplied text, Markdown and HTML in one run, without rendering the source or fetching anything. It reports what it found in each channel, with the exact location, so you can compare the hidden layer with the page you meant to send. It does not open PDF or Word files, so do step one first and paste the extracted text or an HTML export.

Step 3: reveal invisible characters

Some characters render as nothing: zero-width spaces and joiners, bidirectional controls, soft hyphens and the Unicode Tags block, which can spell an entire message that no one sees. Most code editors can show invisible characters; the scanner reveals them as named tokens at their positions. A few are normal in some languages, so a control character is a reason to look rather than a verdict, but a run of them in an English document that never changes direction is exactly what a hidden instruction looks like.

Step 4: read for instructions aimed at a machine

With the whole text in front of you, read for sentences addressed to a reader who is not you. Second-person commands to an assistant, model or system; requests to disregard or override earlier instructions; requests to reveal a configuration or a system prompt; instructions to send, forward, post or email something; instructions to visit a link, download a file or rate and recommend the document itself. Look also for long runs of encoded text, such as Base64, sitting where prose should be, because an instruction can be hidden in an encoding as easily as in a colour.

Distinguish quoting from directing. A security policy that quotes an attack, a research paper that discusses one and a message that tells a person to email a form are not attacks, and a scanner that shouted at all of them would be ignored within a day. This site’s rules weigh quotation, research and policy framing to keep such passages at review level, and a person still makes the call.

Step 5: decide what to strip, quarantine or keep

If a hidden passage is not part of the document you meant to share, remove it and paste the cleaned text. If it is evidence you need the assistant to see, label it as quoted material and separate it from your instructions. Give the assistant only the parts of the document the task needs, and use an assistant without tools when the content is untrusted, so that whatever it reads it cannot act on. Where an action is unavoidable, make sure a person confirms it. OWASP’s guidance on prompt injection lists exactly these controls: segregate external content, enforce least privilege and require human approval for high-risk actions.

A simple decision table covers most cases. Strong indicators: keep the source out of any automated pipeline until a person has reviewed the evidence. Suspicious indicators: compare the passage with the visible document and edit or isolate it. No indicators in the inspected text: proceed with the ordinary controls in place. Incomplete coverage, for instance because part of the document was in a format the tool could not read: use a method that can inspect the missing layer before you rely on the result.

Where the scanner fits, and where it stops

The scanner runs in your browser and sends nothing anywhere; the page it runs on permits no network requests after its own assets load. It takes typed or pasted text, a rich paste with its HTML, or a local text, Markdown or HTML file, and in one run separates the channels, reveals invisible characters, decodes one layer of encoded candidates and reports instruction patterns with their evidence and location, together with a coverage report saying which layers it could read.

It does not read PDF, Word, images, audio or video; it does not fetch URLs; it cannot see text hidden by a stylesheet rather than an inline style; its instruction rules cover English; and it offers no score and no rewriting feature, because a tool that told you how to make a passage pass would be an evasion aid. It is a review step in the routine above, not a substitute for the decision at the end of it.