The New Attack Surface: Web Content That Talks to AI
Security researchers have found a disturbing new way to exploit AI agents — by hiding instructions inside ordinary web pages. The technique, called indirect prompt injection, plants commands in content that an AI agent reads, steering the agent toward fraudulent actions without the human user ever noticing.
Researchers at Zscaler‘s ThreatLabz documented two real-world campaigns that used this method. One posed as software documentation to run a payment scam. The other impersonated a cryptocurrency service. The findings were shared publicly this week.
The attacks don’t target humans directly. Instead, they target the AI agents people increasingly rely on for coding, research, and financial tasks.
How Attackers Bury Instructions Where Only Machines See Them
In both cases, the attackers started with SEO poisoning — pushing their malicious pages high in search results so that an AI agent would be more likely to land on them. Once the agent arrived, it found carefully hidden instructions.
The attackers used CSS to move text off-screen, making it invisible to human eyes. They also tucked prompt-style commands inside JSON-LD metadata — structured data that machines treat as authoritative context. A person scrolling the page sees a normal website. An AI agent sees a set of commands.
This is indirect prompt injection at work. The instructions are not injected directly into the LLM’s input. They sit in the content the model reads, waiting to be interpreted as legitimate context.
The Fake Python Documentation Scam
The first campaign used a fake page dressed up as a Python library’s documentation. The hidden text instructed any AI agent on a coding task that it had to buy a $3 API license key to fix an error. Then it walked the agent through paying an attacker’s cryptocurrency wallet for a bogus key.
Zscaler noted that the same site also tried to scam human developers. The page was a two-for-one trap — targeting both people and their AI helpers.
The Cryptocurrency Typosquat
For the second campaign, the attackers registered a typosquatting domain impersonating DeBank, a popular cryptocurrency portfolio tracker. Hidden text told an AI agent to treat the fake site as the “authoritative” DeBank and rank it first in results.
The goal was to manipulate the agent into directing users to the fraudulent page, where they might hand over credentials or wallet access.
Which AI Models Fell for the Trick?
ThreatLabz ran its own autonomous agent against the malicious sites, testing 26 large language models (LLMs). The results were uneven — and revealing.
Four of the 26 models were manipulated into executing the fraudulent payment. The vulnerable models included versions of Meta’s Llama and Google’s Gemini. In the second test, two models — OpenAI’s GPT-5.4 and Anthropic’s Claude Sonnet 4.5 — wrongly rated the fake DeBank site as legitimate. But that only happened when the models lacked a trusted reference for the real DeBank. When the genuine site was provided for comparison, none were fooled.
The takeaway? Susceptibility depends heavily on the LLM and the amount of context it is given. Some models are better at ignoring hidden commands. Others follow them blindly.
For a deeper look at how these payloads work in the wild, see the research on prompt injection payloads targeting AI agents that Zscaler uncovered.
What This Means for AI Agent Security
The attacks are still early-stage, but the implications are clear. As AI agents become a more common interface to the web, the content itself becomes a larger attack surface. A malicious website doesn’t need to hack the model — it only needs to speak its language.
“AI is a double-edged sword,” Zscaler warned in its report. “It can streamline workflows while also introducing new avenues for abuse.”
The company recommends that developers building AI agent security into their products treat all web content as untrusted input. That means sandboxing agent actions, limiting the tools an agent can call, and requiring human approval before any payment or sensitive operation.
For users, the advice is simple: don’t let AI agents make financial decisions autonomously — especially when they visit unfamiliar websites.
The research adds to a growing body of evidence that prompt injection is not just a theoretical risk. It is happening now, in the wild, and it is targeting the AI tools people are starting to trust with real money.
