... scan of 1.2 billion URLs found 15.3K validated prompt injections sitting on live pages, and about 70% of them are in HTML you never render. The fix most teams reach for - strip the page to plain text before you send it - is the worst of the four options tested. Two of the last three things I've written here were about reading the primary document instead of the coverage. This one is about a paper almost nobody covered, which ... ... worse, because it changes a line of code a lot of us shipped this year without thinking about it. If your product has a "paste a URL" box, a link unfurler, an enrichment step, a competitor