Text that says one thing to you and another to the model

Documents, e-mails and web pages can carry instructions a human never sees: Unicode tag characters that render as nothing, zero-width joiners, bidirectional overrides that flip what the eye reads, and homoglyphs from other scripts. An LLM reads all of it. The scanner exposes those characters and then matches the normalised text against the OWASP LLM01 injection families, tool-poisoning markers and common secret formats.

A hit is a reason to look, not a verdict: legitimate text sometimes contains a zero-width joiner from a copy-paste. Two or more findings in one document, or any exfiltration pattern pointing at a URL, is a different story.

Anything that feeds an assistant, from a support inbox to a CV pipeline, should pass through a check like this before the model sees it. That control is cheap; its absence is a finding.