You paste a paragraph into a document. It looks perfectly normal. Clean words, sensible sentences, nothing strange.
Then an AI agent reads that same paragraph and does something you never asked it to do.
Welcome to one of the oddest security problems of the AI era. Text can carry instructions that humans cannot see, and AI agents will often follow them anyway. The fix starts with something surprisingly familiar: cleaning your text properly.
What Invisible Characters Actually Are
Every character you type is stored as a Unicode code point. Most of them are letters, numbers and punctuation you can see. Some of them are not meant to be seen at all.
A few common examples:
Zero-width space (U+200B). Takes up no visible space but still exists in the text.
Zero-width joiner and non-joiner (U+200D and U+200C). Used in some scripts and emoji to control how characters combine.
Byte order mark (U+FEFF). A marker that sometimes sneaks into copied text from certain files.
Directional overrides (such as U+202E). Change the display direction of text, which can make what you read differ from what is stored.
Unicode tag characters (the U+E0000 block). Invisible characters that can quietly encode ordinary letters.
Most of the time these are harmless leftovers from copying and pasting between apps. But they can also be used deliberately, and that is where AI agents come in.
Hidden instructions do not even need special characters. White text on a white background, tiny fonts, HTML comments and stray markup can all hide text from human eyes while leaving it perfectly readable to a machine.
Why AI Agents Fall for It
A human reads what is displayed on screen. An AI model reads the underlying text.
That gap is the whole problem. The OWASP guidance on prompt injection, the top-ranked risk in its list for large language model applications, notes that injected instructions do not need to be human-visible or readable, as long as the model parses the content. One of its examples describes a user asking an AI to summarize a webpage that contained hidden instructions, which led the model to leak the private conversation.
Now imagine that model is not just summarizing. Imagine it is an agent that can send emails, update records, book meetings or move files on your behalf. A hidden instruction in a document it reads could ask it to do any of those things.
The agent is not being malicious. It simply cannot always tell the difference between content it should process and instructions it should obey.
Where Agentic AI Identity Security Comes In
Cleaning text helps a lot, and we will get to the practical steps in a moment. But clean text alone cannot solve this problem, because new content arrives constantly and attackers keep finding new ways to hide instructions.
The second layer of defense is controlling what an agent is allowed to do in the first place.
Ory, for example, explains how to give AI agents their own identity separate from the human they work for, and that approach to agentic AI identity security means an agent is authenticated as itself, granted only the specific permissions it needs, and tied to a clear record of what it did.
Why does that matter here? Because it limits the blast radius.
If an agent reading your inbox only has permission to read and summarize, a hidden instruction telling it to forward everything to a stranger simply fails. The instruction may still be in the text, but the agent has no authority to act on it.
Think of it as two locks on the same door. Clean text reduces the number of hidden instructions that reach the agent. Tight identity and permissions reduce the damage any instruction that slips through can cause.
How to Clean Text Before an Agent Reads It
This is where good text hygiene becomes a genuine security habit rather than just tidiness.
Strip formatting first. Styled text from web pages, emails and word processors can carry hidden markup. Running content through a text formatting remover turns it into plain text, which removes a whole category of hiding places at once.
Normalize spacing. Unusual spacing can disguise hidden characters or separate words in strange ways. The extra space remover helps reset text to predictable spacing.
Search for suspicious characters. If you suspect something is lurking, a find and replace tool lets you search for specific characters, such as zero-width spaces, and remove them.
Remove what the agent does not need. URLs, email addresses and hashtags may be irrelevant to the task. The main Plain Text Converter includes options to strip URLs and emails before text goes anywhere else.
Be wary of copied content. Text copied from websites, shared documents and emails from unknown senders deserves the most scrutiny.
None of this makes text perfectly safe. It does make hidden instructions much harder to smuggle in.
Build Good Habits Around Agents
If you or your team are starting to use AI agents, a few habits go a long way.
Treat external content as untrusted. Anything the agent reads from outside your organization could contain instructions.
Separate reading from acting. Where possible, let agents summarize or draft, and keep a human approving actions like sending, deleting or paying.
Give each agent its own identity. Do not let agents quietly borrow a human’s full account and permissions.
Keep permissions narrow. An agent that only needs to read calendars should not be able to send email.
Keep a record. Logs showing what each agent did, and why, make problems much easier to spot and fix.
Clean inputs by default. Make plain-text conversion a normal step in any workflow that feeds content to an agent.
The Bottom Line
Invisible characters are a strange reminder that what you see is not always what a computer sees. For years that gap was mostly a nuisance, causing broken formatting and odd spacing. With AI agents, it has become a security issue.
The good news is that the defenses are practical. Clean your text so fewer hidden instructions reach the agent. Give agents their own identities and only the permissions they truly need, so that anything slipping through cannot do much harm.
Paste, clean, check, and limit. It is a simple routine, and it keeps both you and your AI tools doing exactly what you intended.