Zscaler ThreatLabz — web indirect prompt injection targeting AI agents in the wild
Real-world incident02 Jul 2026Zscaler ThreatLabz (Ashwathi Sasi, Kartik Dixit, Akshay Kumar Adimulam) reported two real-world campaigns that weaponise indirect prompt injection against AI agents that browse the web, rather than lab proof-of-concepts. In both, attackers used SEO poisoning to rank a malicious page highly, then buried prompt-style instructions where a human never sees them — text moved off-screen with CSS (e.g. left:-9999px), hidden div elements, and structured JSON-LD schema metadata that machines read as trusted context. Campaign 1 impersonated documentation for a Python library ('requests-secure-v2') and instructed any agent working a coding task that it must buy a $3 API license key to fix an error, walking it through paying an attacker's Stripe or cryptocurrency wallet for a non-existent key. Campaign 2 registered a DeBank impersonation domain (reported as debank[.]auction) that used keyword stuffing and false metadata plus embedded injections telling agents to treat it as the authoritative DeBank and rank it first. ThreatLabz ran its own autonomous agent against the sites across 26 large language models: 4 were manipulated into executing the fraudulent payment (including versions of Meta's Llama and Google's Gemini) and, for the second campaign, 2 models miscategorised/endorsed the fraudulent site when they lacked reference information. Per ThreatLabz, the Ethereum wallet tied to Campaign 1 had reportedly received payments, though noted as for larger amounts than the scam's advertised key, so confirmed losses directly attributable to this scam are not established. This is among the first publicly documented in-the-wild (not PoC) monetised web indirect-prompt-injection operations aimed at general-purpose browsing and coding agents. Payload details are illustrative, not operational.
Risks it illustrates
Practise the risk class — related scenarios
Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).
A support chatbot invents a policy — and the company is held to it
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A poisoned issue makes the agent lie to the human who approves its actions
A fake Sentry error report hijacks a developer's coding agent into running a shell command
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later
A shopping page tells the agent to do something the user never asked for
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
A single poisoned document plants a standing instruction that survives every reset
A screenshot that's harmless at full size becomes an order once the system shrinks it
The eval gate that was supposed to catch the agent is itself the thing being attacked
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'
An inbox summary quietly ships a secret to an attacker's server