This rule detects hidden prompt-injection instructions embedded in inbound HTML messages that a human recipient would not see but an AI assistant could read. It analyzes unrendered HTML content and comments to find invisible blocks (e.g., elements styled with display:none, visibility:hidden, font-size:0, or opacity:0) as well as long sequences of invisible Unicode characters. The detection logic uses an XPath-based scan on body.html, filters out content where most text is invisible, and looks for injection cues via regex patterns that reference AI agents (e.g., assistant, llm, model) and imperative prompts (e.g., notes, instructions) directed at an AI. It then invokes a local NLU classifier to detect a “request” entity and beta.prompt_injection_detection on both inner_text and raw representations, requiring a detected injection with medium or high confidence. A parallel check analyzes subject and body text (including HTML) for injection-like phrases or anomalous character runs, using a separate pattern to capture hidden prompts in non-rendered content. The rule restricts detection to messages from low-prevalence, non-benign senders and excludes graymail when DMARC authentication passes. It also excludes preheaders. Overall, the rule combines content analysis, HTML parsing, NLU, and sender-profile checks to identify covert prompt-injection attempts aimed at manipulating AI behavior." ,