Invisible HTML Prompt Injection in Claude.ai

Elgonad .@elgonad

•updated Mar 20, 2026•2•0•77

Detects the presence of HTML tags within the URL query parameters of Claude chat application pre-fill URLs. Attackers can use this to embed invisible instructions (prompt injection) that the AI processes but the user does not see in the chat interface.