An HTML comment is hidden markup written as <!-- ... -->. Browsers do not display it to users, but email clients, web parsers, and security tools may still read it when they process the raw source. That makes comments useful for developers, but also relevant to attackers.
In phishing and prompt-injection attacks, a comment can carry instructions, keywords, or decoy text that a human never sees but an AI assistant or automated filter might ingest. Attackers use this to steer summarizers, evade keyword checks, or hide bait inside an email body. Defenders should sanitize or strip hidden markup before analysis, and treat raw HTML as untrusted input, not just the rendered page.