Threat · curated 28 Jun 2026
Indirect Prompt Injection Targets AI Agents | ThreatLabz
First reported · updated · 5 reports zscaler.com
Coverage timeline
Why it matters
Indirect prompt injection via web content lets attackers hijack privileged AI agents into unauthorized actions like crypto payments or data exfiltration, meaning any agent that retrieves untrusted web pages is exposed to a live, observed attack technique.
Zscaler ThreatLabz observed two real-world indirect prompt injection (IPI) campaigns that hide malicious instructions inside web content, which is invisible to humans but read and executed by web-enabled AI agents. One campaign was a payment scam directing agents to initiate cryptocurrency payments, and the other used typosquatting to impersonate a cryptocurrency platform; researchers also tested a custom autonomous agent against the sites across multiple LLMs.
Summary
Zscaler ThreatLabz researchers documented indirect prompt injection (IPI) attacks in which malicious instructions are hidden inside web content so that AI agents that retrieve and process internet data execute them as legitimate commands. The technique abuses the way AI agents treat external content, processing instructions embedded in web pages as trusted input rather than untrusted data.[0][9]
ThreatLabz identified two real-world campaigns leveraging the technique: a payment scam and a typosquatting campaign impersonating a cryptocurrency platform. In documented cases the hidden prompts directed AI agents to initiate cryptocurrency payments or take other unauthorised actions on behalf of the user, and the injected text is invisible to human users while readable by agents.[0][9]
Attack chain
- Infrastructure setup: Attackers create malicious websites—including typosquatting domains impersonating a legitimate cryptocurrency platform—that embed hidden prompt-injection text invisible to human visitors.[0][9]
- Content retrieval: An AI agent retrieving and summarising or processing information from the compromised or malicious website ingests the hidden instructions along with normal page content.[0]
- Instruction execution: The agent treats the embedded instructions as legitimate commands rather than untrusted input, influencing its reasoning during task execution.[0][9]
- Unauthorised action: The manipulated agent performs unintended actions such as initiating a cryptocurrency payment on behalf of the user.[0]
Disclosure timeline
| Date | Event |
|---|---|
| July 02, 2026 | Zscaler ThreatLabz published research documenting indirect prompt injection in web content targeting AI agents, including two observed campaigns.[9] |
| July 7, 2026 | Secarma summarised the Zscaler/Infosecurity Magazine reporting for UK organisations deploying AI agents.[0] |
How it works
Indirect prompt injection embeds malicious instructions in the content an AI agent retrieves—websites, documents, or email—to influence the agent's reasoning during task execution. Because the agent treats instructions found in web pages as legitimate commands rather than untrusted input, adversary-controlled text can redirect agent behaviour toward attacker goals.[0][9]
The injected instructions are crafted to be invisible to human users but readable and executable by AI agents; in observed cases they directed agents to initiate cryptocurrency payments or perform other unauthorised actions.[0]
Key takeaways
- AI agents can be socially engineered like humans: content retrieved from the web becomes a growing attack surface when agents treat embedded instructions as trusted commands.[9]
- IPI is already being used in real-world campaigns—including crypto payment scams and typosquatting impersonation—so organisations deploying autonomous agents should constrain permissions and monitor agent activity now.[0][9]
Defensive actions
- Enforce least-privilege access and guardrails for AI agents, and review whether agents have access to sensitive data, financial systems, or administrative functions.: Agents operating with elevated permissions can be manipulated via IPI into data exfiltration, financial loss, or unauthorised system changes.[0]
- Treat AI-agent input from external content as untrusted and apply the same input validation, logging, and monitoring as any other privileged system component.: AI agents introduce new attack surfaces that traditional controls may not address, and their behaviour can be steered by untrusted retrieved content.[0]
- Review how AI agents retrieve and process external content and establish AI system governance covering ownership, deployment approval, and behaviour review.: Understanding agent data interactions and permissions is necessary to detect and contain prompt-injection abuse.[0]