Inspect supplied textual layers separately
Hidden prompt injection in HTML, Unicode and encoded text
An instruction does not need to be prominent in visible prose. Supplied HTML and Markdown can carry comments, attributes, destinations and inert code-like text, while Unicode controls or encoding can make a sequence difficult to notice. The scanner separates those channels without rendering the source.
HTML channels the launch can inspect
The browser worker tokenizes supplied HTML with a pinned, non-rendering parser. It keeps visible body text separate from comments, metadata, accessibility values, remaining attributes, link labels, link destinations, script text, style text and text hidden by supported inline mechanisms. Destination strings are displayed as inert text and never become clickable links.
This separation matters. A link label can describe one destination while the underlying value says another thing. Legitimate alt text or a framework template can resemble an instruction without being malicious. Evidence names the channel and original location so a reviewer can compare the source roles instead of reading one flattened block.
What “hidden HTML” does not mean here
Launch recognizes a closed set of inline declarations such as the hidden attribute and selected inline style values. It does not load stylesheets, resolve class or ID selectors, compute cascade or layout, evaluate media queries, inspect clipping or off-screen position, compare colors, or create pseudo-element content. External resources are not fetched.
The result carries those limitations even when every supported HTML channel finishes. A source application or browser can also omit or sanitize clipboard HTML. The rich clipboard profile records only the representations supplied by that paste event; it cannot reconstruct the original document.
Unicode and derived views
Direction controls, zero-width or default-ignorable characters, confusables, unexpected segmentation and whitespace can obscure an instruction. Core Text produces versioned comparison views with source maps. Every reported excerpt maps back to the original scalar range rather than to destructively normalized text.
Legitimate Arabic, Persian, Indic and bidirectional text is part of the hard-negative suite. A control character is a signal to inspect, not proof of hostile intent. Launch instruction-language coverage is English; preserving another script is not a claim that its instructions were understood.
Bounded encoded candidates
The processor checks a limited number of strictly valid Base64, percent-encoded and HTML-entity candidates, decodes one layer and treats the result as text. It does not execute decoded code, decompress data, decrypt ciphers or recurse through multiple encodings. Ordinary encoded data without an instruction indicator is not a finding.
Candidate count and decoded-byte limits are processing boundaries. If candidate inspection reaches its declared ceiling, the run cannot return a reassuring no-indicator outcome. The newest validated checkpoint may explain completed layers, but the result remains an outcome-free refusal.
Primary references
These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.