How AI is easily fooled in Critical Workflows with simple document formatting

(Originally shared on LinkedIn, April 2026).

This post demonstrates a real prompt injection vulnerability in AI-assisted status review: relevant to any practice integrating AI into document workflows. All it took was changing the colour of a font!

In less than a minute I managed to fool a recent mainstream model into outputting potentially dangerous project information in a way a human would never fall for. What you are looking at is a very simplistic form of prompt injection able to exploit AI’s tendency to be confidently wrong. I used small, invisible tags to imply to the LLM I used that the visible text is actually draft information; the “final status” is hidden too. This is a category of error or attack that’s particularly effective against automated workflows or knowledge systems.

Relying on information conveyed like this could be disastrous for your practice and career. Imagine receiving thousands of pieces of project-critical information, but one or two of them are compromised by a malicious attacker, a messy or compromised document, or a desperate third party taking steps to cover up their mess.

It didn’t take advanced coding knowledge, all I did was make the additional text invisible, an extremely simple step that still works today. Yet this is only one in a wide array of prompt injection methods. On a live project, this could be buried in dozens of pages of complex data, discreetly designed into the document template, or carefully disguised in the visible text to misguide AI.

I even left the filename as “Submittal Prompt Security Test”, and the LLM still didn’t point this out. While the result is “cited” against the original document, unless I check ALL my citations, this risks increasing my confidence in the information rather than reducing risk. Yes humans can miss things, but they don’t confidently reverse a clearly stated position mid-document because something tells them to.

There are ways systems can reduce the likelihood of this risk, but as these methods mature, so does the complexity of prompt injection. This is just one of many ways to fool AI systems. Human review isn’t going away anytime soon, and it’s getting harder to do it competently.

Have you reviewed your systems for the kinds of AI failures a competent professional would be least likely to spot?

As an Architect, I founded vBrief because I know professional review matters. AI has its place, but it’s not in place of professional judgement.

Click here to learn more about how we can help you balance productivity and risk management in your key information workflows.