Indirect Prompt Injection in Web Content Targets AI Agents

Researchers at Zscaler documented two in-the-wild campaigns that used SEO-poisoned sites embedding hidden prompt-style instructions (via off-screen CSS and JSON-LD) to manipulate AI agents: one posed as library documentation to trick agents into making cryptocurrency payments for fake API keys, and another used a typosquatted DeBank site to bias agent trust. Tests against 26 LLMs found several models could be manipulated or misidentify the fake site as authoritative when not given a trusted reference, highlighting prompt injection as an emerging web attack surface against AI agents.