Agent Security
Cloaked Prompt
Also: hidden prompt, invisible instructions
Instructions placed where a model reads them but a person does not, such as white-on-white text, HTML comments, zero-width characters or metadata.
In more detail
A cloaked prompt is a delivery trick for indirect prompt injection. The visible content looks harmless, while text hidden by styling, encoding or tiny fonts tells the model to do something else. Reviewers who only look at the rendered page or diff miss it. Defenses include stripping or flagging hidden text before it reaches the model, and treating every fetched document as untrusted input regardless of how it looks.