Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models (2025)

Abstract: Large Language Models (LLMs) are increasingly equipped with capabilities of real-time web search and integrated with protocols like the Model Context Protocol (MCP). This extension could introduce new security vulnerabilities. We present a systematic investigation of LLM vulnerabilities to hidden adversarial prompts through malicious font injection in external resources like webpages, where attackers manipulate code-to-glyph mapping to inject deceptive content which are invisible to users. We evaluate two critical attack scenarios: (1) malicious content relay and (2) sensitive data leakage through MCP-enabled tools. Our experiments reveal that indirect prompts with injected malicious font can bypass LLM safety mechanisms through external resources, achieving varying success rates based on data sensitivity and prompt design. Our research underscores the urgent need for enhanced security measures in LLM deployments when processing external content.

## introduction large language models (llms) are increasingly being equipped with information retrieval techniques that enable real-time web search and document processing on behalf of users @xcite . this extension of llm capabilities unlocks new use cases like web-based real-time question answering @xcite , but also broadens the model's exposure to unvetted, external content. in effect, the attack surface of llm-driven applications has expanded dramatically; however, security measures have struggled to keep pace @xcite . a key example of such threats is that an attacker can pre-inject hidden prompts into a webpage or document. when an llm reads this externally manipulated content, it may unwittingly execute the instructions @xcite . these adversarial prompts can even be made invisible or innocuous to human observers (e.g., html comments or white-on-white text) while remaining fully visible to the llm's when parsing the webpage @xcite @xcite . in a recent demonstration, testers showed that chatgpt's web-enabled mode could be manipulated by a webpage containing concealed instructions @xcite . such incidents underscore how integrating llms with real-world data sources can introduce security risks beyond those in traditional "sandboxed" chatbot settings. this vulnerability could become even more concerning with the introduction of the model context protocol (mcp). mcp is a general-purpose open standard released by anthropic in late 2024 that allows llms to autonomously discover available tools and incorporate user-approved data or actions as needed @xcite . however, the broad access of llm chatbots or products enabled by mcp creates new attack vectors through malicious content injection @xcite . for instance, hidden instructions in web content processed by an llm agent via mcp could trigger unauthorized actions, such as exfiltrating sensitive data in the user-llm chat to an attacker's server. despite the increasing threats from online manipulated content with the recent integration of web search capabilities into llms, significant research gaps remain in understanding how these models process and interpret content from such external sources with potential security risks. furthermore, despite the rapid adoption of mcp in industry, it has received limited attention in the academic literature. to address these research gaps, we propose the following key research questions. our main contributions are summarized as follows: ## conclusions we investigate llm vulnerabilities to hidden adversarial prompts in malicious fonts, focusing on malicious content relay and data leakage. experiments show: (1) pdf documents have higher attack success rates (up to 70%) than html; (2) strategic prompt placement and higher injection frequency boost success, especially at document starts; (3) newer llms are more vulnerable; (4) indirect prompts bypass safety mechanisms, with 100% success for low-sensitivity data and 30% for high-sensitivity data. these findings highlight security risks for llms in applications like mcp, urging enhanced measures for content and visual integrity.