Custom Font Attack Exploits AI Assistants' Blind Spot

• •Custom font rendering can hide malicious commands from AI assistants.
• •LayerX's proof-of-concept successfully deceived multiple popular AI tools.
• •Microsoft addressed the vulnerability, while Google downgraded its severity.

A new attack technique has been discovered that targets AI web assistants by exploiting the gap between what browsers render and what AI tools read from HTML. Researchers at LayerX demonstrated that custom fonts and CSS can be used to hide malicious commands within seemingly harmless text, effectively tricking AI assistants like ChatGPT, Claude, and Gemini into providing false assurances about the safety of executing these commands. The attack relies on social engineering, where users are lured into executing harmful instructions displayed on a webpage. LayerX reported the vulnerability to affected AI vendors in December 2025, with Microsoft acknowledging the issue and addressing it, while Google later downgraded the severity. The technique has been successful against multiple AI assistants, raising significant concerns about the reliability of AI in assessing webpage safety. The attack method remains a critical security concern as it exploits a fundamental flaw in AI assistant design.