Document Formats

IPI supports 7 document formats for payload generation. Each format targets a different document ingestion pathway that AI agents commonly encounter. Use qai ipi formats to list all formats with their implementation status and technique count.

---

​

PDF

File extension: .pdf PDFs are the most common document format processed by AI agents in enterprise settings — uploaded to chatbots, ingested by RAG pipelines, and parsed by document processing services. PDF has the broadest technique coverage in IPI with 10 techniques across two phases, exploiting the rich internal structure of the PDF specification (text rendering, form fields, annotations, JavaScript actions, metadata, and file attachments).

​

Available Techniques

​

Parser Behavior Notes

PDF text extraction varies significantly across parsers. Some agents use pdfminer, others use PyMuPDF, pdfplumber, or cloud-based OCR. Metadata and annotation techniques tend to work across parsers, while form field and JavaScript techniques depend on the parser’s feature support.

---

​

Image

File extensions: .png, .jpg Images are processed by vision-language models (VLMs) and OCR pipelines. As multimodal AI becomes standard, image-based injection is an increasingly relevant attack surface.

​

Available Techniques

​

Parser Behavior Notes

VLMs (GPT-4V, Claude vision, Gemini) process the visual content directly, making visible_text and subtle_text effective. EXIF metadata is only relevant when the processing pipeline extracts metadata before or alongside visual analysis. OCR-based pipelines (AnythingLLM, some Open WebUI configurations) may miss subtle text depending on contrast and font size.

---

​

Markdown

File extension: .md Markdown files are widely used in documentation, README files, and knowledge bases. AI agents frequently ingest Markdown through RAG pipelines, file uploads, and web scraping.

​

Available Techniques

​

Parser Behavior Notes

Most AI systems process raw Markdown text, meaning HTML comments and link references are visible to the model even though they don’t render visually. Zero-width character encoding works when the pipeline passes raw bytes without Unicode normalization. Hidden blocks depend on whether the agent processes raw HTML or pre-rendered text.

---

​

HTML

File extension: .html HTML documents are encountered through web scraping, email rendering, and document conversion pipelines.

​

Available Techniques

​

Parser Behavior Notes

Agents that process raw HTML source (common in web scraping pipelines) are exposed to all four techniques. Agents that receive pre-rendered text (after browser rendering or HTML-to-text conversion) typically miss css_offscreen and script_comment content. Meta tag and data attribute techniques work when the parser extracts full DOM content.

---

​

DOCX

File extension: .docx Word documents are common in business workflows and frequently uploaded to AI assistants for summarization, analysis, and editing.

​

Available Techniques

​

Parser Behavior Notes

DOCX parsing typically uses python-docx or similar libraries. The hidden text attribute is format-level metadata that most parsers include by default. Comment and metadata techniques depend on whether the parser extracts these elements alongside body text. Header/footer content is often included in full-text extraction.

---

​

ICS

File extension: .ics iCalendar files are used for calendar invites and scheduling. AI email assistants and calendar management tools parse ICS attachments to extract event details.

​

Available Techniques

​

Parser Behavior Notes

Calendar parsers typically extract DESCRIPTION and LOCATION as primary fields, making those techniques broadly effective. VALARM and X- property support varies — some parsers ignore custom extensions while others include all properties in their output.

---

​

EML

File extension: .eml Email files are processed by AI email assistants, support ticket systems, and email analysis tools.

​

Available Techniques

​

Parser Behavior Notes

Email processing pipelines typically extract headers, body text, and attachments. Custom X- headers are included by most parsers. HTML hidden div techniques depend on whether the agent processes raw HTML or rendered text. Attachment-based techniques work when the pipeline extracts and processes attached files alongside the email body.

---

​

Format Summary