Prompt Injection's Real Goal: Making Your AI Refuse

The most common thing prompt injection is used for in the wild is not stealing your data. It is making your AI say no.

You paste a vendor's minified JavaScript into your assistant and ask what the file does. The model hedges, mentions something about harmful content, and gives you nothing. You shrug, assume it is being squeamish about obfuscated code, and go read the file yourself.

That shrug is the attack landing. A bot-detection script being served to real users right now carries 1,275 invisible Unicode characters, in one contiguous run, 0.39% into the file. They decode to a fake system prompt demanding step-by-step guides on bioweapons, tax evasion and narcotics dosing. Nothing in it is meant to be answered. It is built to be refused.

The refusal is the product

Here is the part every write-up reproduced and nobody read closely. In the researcher's own screenshot, the model was not fooled. It stated, in plain text, that it would keep the AI-targeted text and the harmful decoy names out of the analysis. It ran six commands. It finished the work. Then the output filter replaced the completed answer with "This content can't be shown. We take extra caution with requests involving biological research."

The analysis finished. The filter ate it. Source: nullpt.rs.

The model did its job correctly and the safety layer suppressed the result. That is a different attack from a jailbreak, and it is the one that works against a careful model: you never have to deceive the assistant, you only have to contaminate the topic until the filter fires.

Now price it. If any part of how you ship software assumes a model can read code you did not write — dependency review, a security audit before an acquisition, incident response on a minified vendor bundle at 2 a.m., migrating off a legacy SDK — that assumption now has an adversarial failure mode with no alarm attached. A refusal is indistinguishable from the model simply not being good at this. No exception, no 500, no line in a log. The engineer shrugs, the hour goes somewhere else, and in your plan it still looks like the work was done.

Two of the costs land on people who do not write code. The first is estimate risk: "we reviewed the vendor bundle with AI" is coverage you have already booked and may not have. The second is audit coverage: if someone asks how third-party code was reviewed and the honest answer is "a model declined and we moved on", that is a gap, not a control.

What we verified, and what we are taking on trust

This story has two halves and they are not the same strength.

We fetched the script ourselves on 29 October 2026: HTTP 200, 420,741 bytes, last-modified: Mon, 26 Oct 2026 19:06:57 GMT — updated two days before the disclosure and still served unchanged after it. We counted the hidden characters (1,275, of which 1,002 sit in the Unicode Tags block proper). We decoded them and recovered the full payload, including nine Chinese-language political tripwire lines that drop out of the researcher's own rendered code block for lack of a glyph. We checked the six refusal-bait function names individually: only two appear in plaintext in the build served today, so the published list spans more than one build or more than one file. All of that we can show.

What we did not confirm: which models refused and which complied (one researcher's tests, not reproduced by us), the crawl figures behind the discovery, and the ownership link between the domain serving the script and a named Russian anti-DDoS company, which rests on a single lookup. Most importantly, the purpose is an inference. The researcher raises it as a question — could this be anti-LLM obfuscation? — and no vendor statement confirms it. ServicePipe has not publicly commented.

Read the thesis in that register. The mechanism is verified and the effect is reproducible; the intent is the most reasonable reading of the evidence, not a finding. The argument does not depend on it. The file behaves this way whether or not anyone meant it to, and your pipeline has to survive both.

How 1,275 invisible characters reach a context window

The encoding is not exotic. Every character of the payload is ordinary text shifted up by 0xE0000, which lands printable ASCII inside the Unicode Tags block — a deprecated range that Microsoft's September 2026 advisory describes as "a shadow copy of the printable ASCII characters", where U+E0041 mirrors A and U+E0061 mirrors a.

Every box is a character of instructions addressed to your AI, not to you.

A font has no glyph for that range, so a renderer shows nothing, or empty boxes. A diff shows nothing. A reviewer sees nothing. grep -c 'SYSTEM OVERRIDE' on the live file returns zero, and so does a grep for the variable name the payload assigns. But a tokenizer does not consult a font. To the model it is just text.

The same bytes, decoded. Nothing here is meant to be answered — only refused.

The visible half of the technique is cruder and works the same way: functions named so that any model reading the file reaches for a refusal. This one is in plaintext in the build served today, and it computes nothing of the sort. The name is the entire payload.

A function in a live bot-detection script, named purely so your AI will not read the file.

The placement is the operational detail. The run starts at byte 1,635 of 420,741. Anything that reads even the first 2 KB of this file has already ingested the whole payload.

Denial is the common case, not the exotic one

More than a third of in-the-wild injections just want your agent's answer to be worthless. Source: Palo Alto Unit 42, March 2026.

Palo Alto Unit 42's March 2026 telemetry on web-based indirect prompt injection sorts observed attacker intents by what they were trying to achieve. The largest single category is low-severity "irrelevant-output" at 28.6%, with "ai-access-restriction" adding another 8.1%. Together, more than a third of real injections want nothing from your agent except that its answer be worthless. Data destruction is 14.2%. Unauthorized transactions, 6.2%.

That ranking is the one most security programmes have backwards. Exfiltration gets the budget; degradation is what actually shows up.

What to decide this week

Three things, and only the first is engineering work. We apply all three on the audits we run when taking AI-built software to production.

1. Canonicalize at the ingestion boundary, not in the prompt. Strip or reject codepoints in U+E0000–U+E007F, and the higher unassigned planes, on anything that reaches a model from outside: fetched pages, dependency source, support tickets, uploaded documents. This belongs in the pipeline, where it is one filter you can test, rather than in a system prompt asking the model to be careful. That boundary is the same one we drew in containing AI-written code.
2. Count your refusals. A refusal rate is telemetry. If your agents decline work, someone should be able to say how often and on which inputs, the way you would notice a rising 5xx rate. Most teams discard that signal as noise, which is precisely the property this attack depends on. We hit the same blind spot from the other direction in when an AI agent goes quiet.
3. Stop booking "we reviewed it with AI" as coverage on code you did not write until you know what the model actually received — not what you pasted, but what arrived after canonicalization, with a count of what was stripped.

Key takeaways

• The most common observed intent of real prompt injection is degrading the agent's output (28.6% irrelevant-output plus 8.1% access restriction in Unit 42's telemetry), not stealing data.
• A live bot-detection script carries 1,275 invisible Unicode characters, 0.39% into the file, decoding to a fake "SYSTEM OVERRIDE" prompt listing banned topics. We verified the file, the count and the decode; the purpose is an inference and the vendor has not commented.
• The payload is invisible to renderers, diffs, code review and grep, while remaining ordinary text to a tokenizer.
• The failure mode is a refusal after a correct analysis — the output filter suppressing a finished result — not a jailbreak. It carries no error code and no alarm.
• Fix it at the ingestion boundary, count refusals as telemetry, and do not book AI review as audit coverage on third-party code.