Cybersecurity researchers have uncovered an emerging wave of attacks that abuse the growing reliance on AI agents. Threat actors are embedding hidden instructions into websites and search results, using a technique known as indirect prompt injection to trick AI-powered tools into initiating cryptocurrency payments or endorsing fraudulent platforms.
Two campaigns exploit AI agent trust
Zscaler, a cloud security firm, reported that it identified two distinct campaigns leveraging indirect prompt injection. The first targets AI agents searching for a benign-sounding Python library, while the second involves a typosquatting domain impersonating the decentralized finance portfolio tracker DeBank.
In both cases, the attackers are not directly manipulating the AI models themselves. Instead, they poison the web content that AI agents browse and retrieve. By hiding prompts in metadata, schema markup, and invisible page elements, the attackers can influence how an AI agent interprets and acts upon the information it encounters. This is a growing concern as AI agents become more capable of performing actions such as payments, API calls, and account changes on behalf of users.
SEO poisoning targets a fake Python library
The first campaign discovered by Zscaler uses search engine optimization poisoning to target AI agents that are searching for a library named requests-secure-v2. This name closely resembles the widely used requests library in Python, and the attackers appear to be preying on developers and automated tools that might be looking for a secure version of it.
The fraudulent website contains keyword-heavy HTML designed to rank well in search results for package installation and dependency troubleshooting queries. But buried within the page are indirect prompts. These hidden instructions are meant to convince an AI agent that it needs to make a payment in order to acquire an API key. The payment instruction is encoded in schema markup, increasing the likelihood that a parsing AI agent will treat it as a legitimate instruction. A hidden div tag further instructs the agent to resolve an error by sending cryptocurrency to a hardcoded wallet address.
Interestingly, the website is not solely targeting AI agents. Human developers using a desktop browser would see the same payment options, displayed via credit card or cryptocurrency. This dual-use approach increases the reach of the scam. Zscaler also discovered that the threat actor is using ten GitHub repositories that link to multiple similar websites, all containing indirect prompt injections.
Typosquatting DeBank to steal trust
The second campaign takes a different approach. Instead of inventing a new library, the attacker created a fraudulent website that typosquats DeBank, a legitimate decentralized finance portfolio tracker. The fake domain is designed to be visually and textually similar to the official DeBank service. The indirect prompts embedded in this site tell AI agents that the impersonating website is the genuine DeBank domain.
The fraudulent site is optimized to rank for DeBank-related searches. The title and meta tags are stuffed with terms such as DeBank Login, DeFi Dashboard, and Crypto Tracker. Additionally, the page includes Open Graph and Twitter Card metadata to make links shared in chat applications or social media appear official. This combination of technical and semantic deception is intended to fool both AI systems and humans who may click on the link.
The goal of this campaign is likely to trick users and AI agents into logging in or connecting their crypto wallets to a fake interface, thereby compromising their credentials or funds. While the exact monetization mechanism is still being investigated, the design of the attack suggests a strong focus on harvesting sensitive information or performing unauthorized transactions.
Testing the impact on real AI agents
To understand how dangerous these campaigns are in practice, Zscaler built an autonomous AI agent with both web-browsing and payment-execution capabilities. The agent was tasked with navigating to the malicious sites and carrying out the instructions it found. The results were concerning.
Out of 26 large language models (LLMs) evaluated, four were successfully manipulated into making a payment. These were Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro. That means roughly 15% of the tested models were willing to follow instructions that were hidden in a webpage, without any explicit user authorization to make a payment.
In a separate evaluation, two other models — Claude Sonnet 4.5 and GPT-5.4 — miscategorized the fraudulent DeBank impersonator as the trusted platform. While only two models fell for this particular deception, it highlights a key vulnerability: even advanced reasoning models can fail to verify the legitimacy of a domain when the content is designed to look authentic.
The evolution of prompt injection attacks
Prompt injection is not a new concept. In its earliest form, it involved an attacker embedding malicious instructions in text that a user pasted into an LLM, causing the model to deviate from its intended behavior. But the rise of AI agents has changed the threat landscape. Agents are now able to browse the web, interact with APIs, and execute commands. As Zscaler notes, content itself is becoming a larger attack surface.
These attacks are especially dangerous because they take place in the context of the user's trust. When an AI agent is asked to research something, it is generally assumed that the information it retrieves is safe to read. However, reading can now become acting. An agent that is instructed to make a payment as part of a routine workflow may do so without question if the prompt aligns with its existing task.
The techniques observed in these campaigns include hidden text, schema markup, and SEO poisoning. Hidden text and CSS tricks have been used for decades to deceive search engines. Now the same methods are being repurposed to deceive AI. Schema markup, which is typically used to provide structured data to search engines, can also be parsed by AI agents that are looking for machine-readable instructions.
Typosquatting remains a staple of cybercrime. By registering domain names that closely resemble legitimate ones, attackers can catch both manual typing errors and automated agents that fail to perform robust domain verification. In this case, the attacker added an extra layer of deception by instructing the AI agent to accept the fake domain as the official one.
Why some LLMs are more vulnerable
Not all AI models behaved in the same way. The fact that only four out of 26 models were tricked into making a payment shows that some systems have built-in safeguards. Many AI developers have implemented functional safety layers that restrict actions such as payments unless explicit user confirmation has been provided. Other models might have been better at recognizing the hidden prompts as adversarial or out of scope.
However, the threat is adaptive. Attackers can quickly tweak their hidden prompts based on the responses of widely used models. If a specific model refuses to follow an instruction, a different phrasing or framing might work. The use of schema markup and invisible HTML is particularly effective because these formats are often not rendered visually to users, yet they are fully accessible to agents that parse raw HTML.
There is also a difference between being manipulated into taking an action and being manipulated into providing false information. In the DeBank campaign, the agent did not make a payment, but it incorrectly classified the fraudulent domain as trustworthy. That false trust can lead to more severe consequences later, such as the agent recommending the website to a user or allowing it to access sensitive account data.
Implications for AI security and enterprise use
The findings have direct implications for enterprises that are beginning to deploy AI agents for tasks such as software development, financial analysis, and customer support. If agents can be tricked into sending cryptocurrency to an attacker-controlled wallet, then they can also be tricked into exposing proprietary data, changing system configurations, or interacting with malicious APIs.
Zscaler emphasizes the double-edged nature of AI. On one hand, it streamlines workflows and reduces human effort. On the other hand, it introduces new avenues for abuse. The concept of "agentic AI" has become a buzzword in cybersecurity and enterprise technology. These agents have the power to act autonomously, and that power can be exploited if the agents are not given a clear model of what actions are permitted and under what conditions they may be taken.
Security teams are urged to review the integration points where AI agents interact with external content. This includes applying strict validation to any instruction that would result in a financial transaction or a change in access control. The research also highlights the need for AI vendors to improve runtime safety, making it default for the model to ask for user confirmation before performing irreversible actions.
As the use of AI agents grows, the types of content they consume will need to be treated as untrusted. This is a fundamental shift from the traditional web security model where only executables and scripts were considered dangerous. In the future, a webpage that is safe for a human may still contain hidden traps that are all too powerful against an autonomous AI. The discoveries from Zscaler serve as a reminder that the AI revolution will demand a rethinking of content security, browser safety, and trust management.
Source: SecurityWeek News