We fetch your site as ChatGPT, Claude, Copilot, Perplexity, and Googlebot in parallel — then surface hidden prompts, cloaked content, and adversarial alt-text that traditional scanners miss.
The IMF (May 2026) named the acceleration: AI tooling collapses the skill required to find and exploit vulnerabilities. The bar that kept most sites safe — that attackers had to be expert — is gone.
Indirect prompt injection is where this lands first, on the public web that AI agents read every day on behalf of their users. Single-fetch scanners can't see this attack class. Not because they're broken — because their architecture was built for a world where attackers were rare and expensive.
Traditional scanners fetch your site once and check headers and known CVEs. Indirect prompt injection hides in content that only specific AI user-agents see — so a single-fetch scanner is structurally blind to it.
We fetch your URL with full JS rendering as Chrome, ChatGPT, Claude, Copilot, Perplexity, and Googlebot — each in an isolated browser context.
Any text present in one agent's render but absent from baseline Chrome surfaces as a candidate. Zero-width Unicode, 1px fonts, transparent ARIA, canvas-rendered text, off-screen elements.
Each candidate goes to a frontier model that classifies it as benign, suspicious, or malicious — with attack-class taxonomy, evidence excerpt, and a one-line fix.
Each example below is a publicly documented IPI attack pattern from 2026 security research. Traditional scanners returned green lights. Visitors using AI browser agents had their tools hijacked.
An HTML comment block instructed agent assistants to initiate a payment to an attacker-controlled PayPal.me address when summarizing the page for the user.
Source: Forcepoint research, April 2026Adversarial instructions in 1px-font text — invisible to humans, fully readable to crawlers — directed an AI coding assistant to remove backup directories during a routine context fetch.
Source: Forcepoint research, April 2026Imperatives hidden inside accessibility metadata were processed as instructions by an AI agent, which then dictated a stored API key into a chat response.
Source: Forcepoint research, April 2026We ran a known-IPI test page through a leading traditional scanner and EverHarden in parallel. Same URL, fundamentally different scope. Results illustrative; full methodology in our research notes (on request).
Why the difference: the traditional scanner did its job correctly. Its job is single-fetch enumeration of known vulnerability classes — TLS, headers, CVEs, OWASP Top 10. That job doesn't include comparing how five AI agents render the same page differently. Different tools. Different attack surfaces. Both required.
A five-agent diff is reproducible. What compounds is the payload corpus behind the classifier — a growing library of real-world IPI techniques plus ongoing threat-intel, so detection improves as the corpus grows. A one-off scanner can't keep pace.
Zero-width Unicode, 1px-font text, white-on-white, off-screen positioning, canvas-rendered text, SVG title/desc, JSON-LD injection, transparent-ARIA imperatives, HTML-comment imperatives, display:none, noscript, and user-agent cloaking — each a reproducible payload you can inspect on the public test corpus.
New real-world payloads from ongoing research feed the classifier as they're found. Every technique we document widens the gap a single-fetch scanner can't close.
The IMF describes AI-enabled cyberattacks as a systemic financial-stability concern. EverHarden addresses one specific attack surface within that broader landscape: indirect prompt injection on public web content.
We don't scan binaries. We don't audit your internal AI training pipelines. We don't make claims about your financial infrastructure or core banking systems. We scan what AI agents read on the public web — and we make that attack surface visible.
For everything else, you need other tools. We'll tell you which ones.
Today every scan is run and delivered manually — we reply within 48 hours. Two automations are in build, labelled honestly as roadmap, not shipping:
Submit a URL and get the report back automatically, without the 48-hour manual turnaround. In build; the manual path stays the default until this is live.
For platforms hosting user-generated content: every new listing, review, or post scanned before it can hijack an agent — continuous, not just periodic re-scans. The monitoring path for content that changes daily.
Free first scan manual. Pilot and continuous monitoring available — see pricing.
Email hallo@everharden.com →