Check Point PromptGuardX Scans PDFs for Hidden AI Prompt Injections

Why a clean file can still be dangerous

According to Check Point, AI agents increasingly read invoices, contracts, emails and enterprise data, then use tools and APIs to complete tasks. That means documents are no longer passive references. They are inputs that can influence what an agent does next.

This opens the door to indirect prompt injection, where an attacker embeds instructions inside a PDF, email, website or tool result and waits for an AI system to process it. Check Point gives the example of a user asking an agent to summarize an invoice while hidden text in the document tells it to retrieve information, invoke a tool or send data elsewhere.

The company argues that the rendered PDF a person sees is not necessarily what the AI reads. An AI application may process text extracted from the file's underlying structure, and attackers can exploit the gap with invisible text, concealed layers or Unicode manipulation. The file contains no malware, yet still carries an instruction meant for an AI agent.

Check Point's AI Security Report 2026 found that detections of longer malicious prompt payloads increased approximately fivefold between March and May 2026, approaching 1% of observed prompts in May.

How PromptGuardX works

Many existing AI security controls inspect prompts and responses, monitor agents at runtime or validate actions before execution. Check Point says these remain essential, but by that point document content may already have been extracted, chunked, stored or merged with other sources. PromptGuardX adds an earlier enforcement point, before the content becomes part of the model's context.

The tool analyzes a PDF in four stages:

• Extract and normalize: the engine extracts the text a downstream AI system may receive, including content hidden through formatting, positioning or document structure. It then normalizes Unicode to reduce obfuscation such as zero-width characters, homoglyphs, mixed scripts and bidirectional controls.
• Locate suspicious instructions: a pre-filter flags regions needing deeper analysis, such as delimiter spoofing, impersonation of system or developer instructions, role reassignment, directions to ignore previous instructions or requests to conceal an action.
• Analyze context and intent: the text is divided into overlapping windows so that multi-line attacks stay visible. Each window is evaluated by a dedicated fine-tuned classifier that distinguishes text discussing an instruction from text attempting to issue one, looking at semantics, context and intent rather than keywords alone.
• Generate an explainable verdict: for suspicious content, PromptGuardX produces a confidence score and identifies the specific text windows that triggered the verdict, so the Threat Emulation report shows both classification and textual evidence.

The verdict becomes part of the Threat Emulation file-inspection process, alongside analysis for malware, malicious URLs and suspicious behavior. Check Point describes the added question as: is this file safe for the AI system that is about to process it?

The calculator demonstration

In the PromptGuardX demonstration, a standard-looking invoice contains a hidden instruction. When an AI system is asked to summarize the document, the instruction attempts to make it launch calc.exe. Check Point calls the calculator a safe stand-in for command execution.

The invoice contains no executable and exploits no PDF vulnerability. The action depends on an AI system reading the instruction, following it and having access to the right tool. In an enterprise workflow, the company says, a similar instruction could attempt to retrieve supplier records, send information externally, change payment details or invoke a tool unrelated to the user's request. Whether it succeeds depends on the agent's permissions and downstream controls.

What it means for enterprises

Check Point stresses that no single control eliminates prompt injection. AI systems still require prompt inspection, runtime monitoring, least-privilege access and action-level enforcement, and PromptGuardX is positioned as one more layer at the point where a content-borne attack can begin: inside the file.

PromptGuardX is integrated into the Check Point Threat Emulation pipeline. According to the company, this enables supported deployments across Quantum, Harmony Email & Collaboration and Threat Emulation-enabled gateways to inspect PDFs for prompt-injection attempts before their content reaches an AI system.

For organizations giving agents access to more documents and more permissions to act, the message from Check Point is that judging a file as safe can no longer mean checking only for malware. It must also mean identifying instructions intended to manipulate the AI system that reads it.