Email Collaboration Threat Protection

Prompt injection vs. scanner evasion

Untangling AI-targeted attacks from the evasion tricks they're confused with

by Alexander Decarne

ago. 27, 2026

Key Points

One label, two threats: The security market now calls almost any hidden character "prompt injection", but true prompt injection is narrower, content crafted so AI reads it as an instruction, not data. Scanner evasion (zero-width text, homoglyphs, encoding) is older and agentic-AI-agnostic. The techniques overlap; the intent doesn't, and conflating them means catching the hiding trick while missing the AI-directed instruction.
The risk is compounding: Indirect prompt injection, instructions buried in emails or web content AI later treats as legitimate, is growing fast, with Google recording a 32% rise between November 2025 and February 2026. Agents act at machine speed with no instinct to hesitate, so a successful injection gets executed before anyone catches it.
Two layers of analysis required: Obfuscation detection and threat/behavioral analysis must run separately, since hidden text alone is common in legitimate email and can't be judged malicious until it's correlated against threat intelligence and behavioral signals. Mimecast's Collaboration Threat Protection runs both, part of its broader approach to securing humans, data, and AI as one attack surface.

In June 2025, one email silently drained data out of a Microsoft 365 Copilot inbox. No click required. The exploit, EchoLeak, scored a 9.3 on CVSS, one of the most severe AI-targeted vulnerabilities disclosed to date.

That's a genuine prompt injection attack. But security teams are now slapping that label on every hidden character or encoded string they find, and the imprecision matters, because it changes how you defend against it.

The problem: two different threats, one overused label

OWASP, one of the leading authorities on web and application security, defines prompt injection narrower than how the term gets used day to day: a prompt injection vulnerability occurs when input alters an LLM's behavior unintentionally, and that input doesn't need to be visible to a human, only parseable by the model. Instructions and data flow through the same channel with no clear separation, so an attacker can craft content the model reads as a new instruction rather than text to analyze. That's a targeted, AI-specific failure mode.

Scanner evasion is older and broader: zero-width characters, white-on-white text, homoglyphs, encoding, payload fragmentation, techniques built to defeat pattern-matching engines long before LLMs existed. The same trick that hides a phishing URL from a legacy scanner can hide a malicious instruction from an LLM. The techniques overlap almost completely. The intent doesn't.

Most of what security teams see today, invisible text, CSS tricks, Unicode manipulation, comment-tag hiding, is scanner evasion, not prompt injection in the strict sense. It only crosses that line when the hidden payload is an instruction aimed at manipulating an AI analysis step, not just slipping past detection. Conflating the two leads to overstated threat claims and defenses that assume "detect the hiding technique" is the same job as "detect the AI-directed instruction."

Why it's getting worse

Both categories are accelerating at once. Indirect prompt injections, instructions embedded in documents, websites, or emails an LLM later treats as legitimate, has become the more dangerous variant as AI copilots get default read access to inboxes and files. Google's own security researchers, scanning 2–3 billion crawled web pages per month, documented a 32% rise in malicious indirect prompt injections between November 2025 and February 2026, including transaction instructions hidden in invisible text, waiting for an AI agent with payment access. Prompt injection has held the top OWASP LLM Top 10 spot for two consecutive editions, and researchers have demonstrated working attack chains against Microsoft and GitHub production systems, both patched before wide exploitation was confirmed.

There's a structural reason this compounds. The modern workforce isn't just people anymore; it's people alongside AI agents that read email and act on corporate data with standing access and no one reviewing every step. Those agents work in milliseconds, faster than any analyst can shadow, so a successfully injected instruction gets executed, not caught on the way out. A person handed a suspicious request might hesitate; an agent told to "forward the attachment" has no equivalent instinct unless the platform built one in. An attacker only needs to compromise one half of that workforce.

What good defense looks like

Effective defense works at multiple layers, because hidden content on its own doesn't tell you whether you're looking at an attack or just an artifact of ordinary email formatting.

First, treat obfuscation detection as its own control, independent of whether an AI system is in the loop, flagging zero-width characters, off-screen positioning, directionality overrides, and fragmented payloads at the content-inspection layer for every message, not just the ones headed for an AI-connected workflow.

Second, don't stop at the flag. Hidden text shows up constantly in legitimate email, footers, accessibility markup, template artifacts, so acting on the obfuscation signal alone produces noise. Correlate it against threat intelligence and behavioral signals, sender reputation, known campaign patterns, deviation from a sender's normal formatting, to determine whether the hidden content is a real payload or just noise.

This matters most for messages destined for AI-connected workflows like Copilot or agent-based email triage, where those systems shouldn't trust inbound content by default. OWASP recommends constraining model behavior through system prompts and segregating untrusted content so it can't influence instructions, but that architectural safeguard works best paired with detection that's already filtered out the obfuscation attempts before they ever reach the model.

The Mimecast angle

Most vendors solve one layer or the other. Mimecast's Collaboration Threat Protection is built to work at both.

At the obfuscation layer, it flags the hiding techniques regardless of intent: zero font, white-on-white, off-screen positioning, CSS/HTML tricks, and Unicode or encoding patterns rarely seen in legitimate business email. Attachments and images are inspected for the same hidden-content techniques.

That first pass alone isn't enough. Hidden text shows up constantly in legitimate email for entirely benign reasons, from marketing footers to accessibility markup, so flagging it on sight would drown analysts in false positives. The second pass is where threat intelligence and behavioral analysis take over: correlating the flagged content against known attack patterns, sender behavior, and threat intel to determine whether the hidden content is actually a payload or just noise. That combination is what separates a genuine prompt injection attempt from obfuscation used for ordinary evasion.

Running both passes independently means analysts don't have to pre-decide which threat they're facing before inspection even starts.

That's the logic behind Mimecast's broader approach to securing humans, data, and AI to protect modern work: the workforce is no longer just people at a keyboard, it's agents acting on their behalf at machine speed, and both need defending as one attack surface.

The bottom line

Prompt injection is a real, fast-growing, AI-targeted threat, not a catch-all for anything hidden in an email. Getting taxonomy right isn't pedantry; it determines whether your defenses catch what you think they're catching. As more workforce decisions get made by both agents and people, that precision matters more, not less. If your AI tools have read access to your inbox, ask your security team which problem they're solving for, and what those agents can reach if one gets it wrong.

Sources

Vectra AI, "Prompt injection: types, real-world CVEs, and enterprise defenses" — https://www.vectra.ai/topics/prompt-injection
SANS NewsBites, Patch Tuesday coverage of CVE-2025-32711 (EchoLeak technical mechanism) — https://www.sans.org/newsletters/newsbites/xxvii-45
OWASP GenAI Security Project, "LLM01:2025 Prompt Injection" — https://genai.owasp.org/llmrisk/llm01-prompt-injection/
Aembit, "OWASP Top 10 for LLM Applications (2025)" — https://aembit.io/blog/owasp-top-10-llm-risks-explained/
Google Security Blog, "AI threats in the wild: The current state of prompt injections on the web" — https://blog.google/security/prompt-injections-web/
GBHackers / Embrace The Red, coverage of GitHub Copilot RCE (CVE-2025-53773) — https://gbhackers.com/github-copilot-rce-vulnerability/