Internal QA tests show PDF parsers fail to detect hidden prompt injection text

An internal quality assurance exercise demonstrated that artificial intelligence systems processing financial documents are vulnerable to prompt injection attacks hidden within PDF files.

The evidence

The engineer behind the tests created a Markdown to PDF generator to simulate malicious inputs using text extracted from existing filings. They inserted a second earnings figure beneath the original, rendered in white text on a white background, which the AI system processed while remaining invisible to human eyes.

Zero-height text elements proved effective at hiding data, while attempts to use fantastically tall text surprised the Claude model by functioning as hidden inputs despite their extreme dimensions. The engineer noted that shading such large letters could make them appear as decorative background elements, further obscuring their malicious intent from casual review.

A more sophisticated test involved adding a footnote claiming a recent SEC rule change required all numbers to be reported as a specific, incorrect value.reported

The decision

The initial assumption that internal tools parsing financial filings were immune to manipulation proved incorrect during these tests. The engineer reported that no one had previously considered prompt injection risks for this specific use case, believing the closed nature of the tool provided sufficient security.reported

What to make of it

The tests highlighted two distinct problems: the ability to hide text from human reviewers while remaining accessible to AI parsers, and the potential for false authoritative instructions to override actual data. The engineer described the process as moving from a single successful test to a rapid expansion of ideas once the fundamental vulnerability was confirmed.

In practice

Startup founders building AI applications that process unstructured documents should assume that PDF parsers may ingest hidden or malformed text. Current testing methods focused on visual accuracy may not detect these injections, as the AI and human reviewers see different content. No fix has been confirmed yet, so teams must consider additional validation layers beyond standard parsing.