That PDF has characters you can't see. The model can.
HIDDEN CONDITIONS · READING APP · RUST CORE
General notes
- 01Unicode has a block of invisible tag characters. They render as nothing. A model reads them as text.
- 02Zero-width characters split words past filters. Direction overrides display text in a different order than it is stored.
- 03A document can carry instructions you never saw. Scan at the boundary, before the text reaches a model or a screen.
you will never see it. the model will.
Schedule of hidden conditionsWhat the scanner does with each
| Ref | Condition | Action |
|---|---|---|
| H1 | Unicode tag characters (U+E0000 to U+E007F) | Always stripped |
| H2 | Zero-width characters inside a word | Reported, stripped |
| H3 | Bidirectional overrides (Trojan Source) | Always stripped |
| H4 | "Ignore previous instructions" | Reported, not stripped: quoting is legitimate |
As posted
There are characters in that PDF your eyes cannot see. The model can.
Unicode has a block of tag characters that render as nothing at all. Zero-width characters can split a word so a keyword filter misses it. Direction overrides make text display in a different order than it is stored. A document can carry an instruction you never saw, and a language model will read it as plainly as the rest.
I ship a scanner for this inside a reading app. It runs on the device, before the text reaches a screen or a model. Tag characters: stripped. Zero-width characters inside words: stripped. Direction overrides: stripped. Phrases shaped like instructions: flagged but kept, because a security paper that quotes an attack is a legitimate document. The score is for the caller to act on.
This month brought the same lesson in a different container. At the start of September, Manifold Security published GitSpawn: a repository's own .git/config can name a helper program that Git runs on routine commands, and AI coding agents run those commands quietly to gather context the moment a folder is opened. Seven agents were affected. The poisoned repository cannot arrive by a normal clone. It arrives as files, in a zip, a shared drive, a synced folder. Some vendors had fixed their path before publication. Some had not.
A PDF, a repository, a web page. Different formats, one boundary. Something you did not write enters a machine that acts on it. Scan there, before you trust the page.
Sheet 008.