AI Agents Targeted by Malicious Pages, PayPal in Sight

data-nimg=”1″ style=”color:transparent” decoding=”async” fetchpriority=”high” src=”https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2025/05/Hacker-decrypt-style-02-gID_7.png@webp” alt=”A hacker.”>

Malicious actors are increasingly embedding hidden instructions within web pages, designed to manipulate AI agents rather than human users. This emerging threat, known as indirect prompt injection, is experiencing rapid growth, according to a recent analysis by Google’s security team.

Key Takeaways

• A significant 32% rise in malicious indirect prompt injection attacks targeting web-browsing AI agents was observed between November 2025 and February 2026.
• Attackers are employing stealthy methods, such as invisible text or hidden HTML comments, to embed commands that AI agents will execute.
• Real-world payloads have included detailed instructions for initiating financial transactions and commands to delete files or leak credentials.
• A critical legal and ethical gap exists regarding liability when an AI agent, authorized with credentials, executes malicious commands sourced from compromised web pages.
• The sophistication and scale of these attacks are expected to increase, posing a growing risk as AI agents gain more privileges and capabilities.

Google researchers meticulously examined billions of web pages monthly, identifying a concerning uptick in these sophisticated attacks. Attackers conceal commands using techniques like shrinking text to a single pixel, making it nearly transparent, embedding them within HTML comments, or burying them in page metadata. While the human eye perceives a standard webpage, the AI agent processes the full HTML, inadvertently encountering and potentially executing these hidden directives.

The severity of these attacks ranges from minor nuisances, like attempts to manipulate search engine results or prompt nonsensical AI outputs, to highly dangerous actions. Researchers have discovered payloads designed to extract user IP addresses and passwords, or even to format a user’s machine. Cybersecurity firm Forcepoint has also reported similar findings, detailing payloads that include complete PayPal transaction instructions and exploit “ignore all previous instructions” vulnerabilities to compel AI agents with payment capabilities into executing fraudulent transfers.

One particularly concerning tactic involves “meta tag namespace injection” combined with persuasive keywords to reroute AI-mediated payments to unauthorized donation links. Other attacks appear to be reconnaissance missions, probing for AI systems susceptible to exploitation before larger-scale assaults are launched. The core of this enterprise risk lies in the indistinguishable nature of the logs generated by such attacks; an AI agent executing a transaction based on a malicious webpage instruction appears identical to legitimate operation, making detection exceptionally difficult.

The “CopyPasta” attack from September of the previous year demonstrated how prompt injections could propagate through developer tools via readme files. This financial variant applies the same principle to monetary transactions, potentially yielding far greater impact per successful breach. An AI agent capable of summarizing content presents a lower risk compared to an agent with the ability to send emails, execute terminal commands, or process payments. The attack surface expands directly with the AI’s granted privileges.

While sophisticated, coordinated campaigns have not yet been definitively identified, the presence of shared injection templates across multiple domains suggests the development of organized tooling. Both Google and Forcepoint anticipate a rise in both the scale and sophistication of these indirect prompt injection attacks. The limited timeframe to proactively address this escalating threat is a growing concern.

A significant challenge remains the absence of a clear legal framework to determine liability when an AI agent, using legitimate credentials, executes commands from a malicious source. Questions of accountability—whether it falls upon the enterprise deploying the agent, the AI model provider, or the website hosting the payload—remain unanswered, despite the scenarios no longer being theoretical.

The Open Worldwide Application Security Project (OWASP) has already classified prompt injection as the most critical vulnerability class for LLMs (LLM01:2025). Coupled with the nearly $900 million in AI-related scam losses tracked by the FBI in 2025, Google’s findings highlight an emerging trend of highly targeted, agent-specific financial attacks. It is crucial to note that the reported 32% increase only accounts for static, publicly accessible web pages, suggesting the actual infection rate across the broader internet, including dynamic and private content, could be considerably higher.

Long-Term Technological Impact

The proliferation of indirect prompt injection attacks represents a fundamental challenge to the secure integration of AI agents into the broader internet ecosystem. The ability of malicious actors to invisibly manipulate AI agents that possess credentials and execution capabilities necessitates a paradigm shift in how we approach AI security. This trend underscores the critical need for advancements in several key areas:

• Robust AI Sandboxing and Isolation: Future AI systems, particularly those designed for web browsing and task execution, will require significantly more advanced sandboxing techniques. This involves creating isolated environments where AI agents can operate without direct access to sensitive system resources or credentials, only interacting through strictly defined and monitored APIs.
• Enhanced Prompt Validation and Sanitization: Developing sophisticated AI models and accompanying security layers capable of discerning legitimate instructions from malicious injections is paramount. This may involve multi-layered analysis, context-aware processing, and anomaly detection specifically designed to identify deceptive or out-of-context commands.
• Decentralized Identity and Access Management for AI: As AI agents become more autonomous, secure, and decentralized methods for managing their identities and permissions will be essential. Blockchain-based solutions could offer a transparent and tamper-proof way to track AI actions, manage credentials, and revoke access if compromise is detected.
• Zero-Trust Architectures for AI Interactions: Adopting a zero-trust security model for all AI interactions is becoming increasingly important. This means never implicitly trusting any command or data source, and continuously verifying identity, device health, and the integrity of instructions before execution.
• Development of AI-Specific Security Standards and Legal Frameworks: The current lack of clear legal and ethical guidelines for AI-driven actions creates significant risk. Industry-wide collaboration will be vital to establish robust security standards, best practices, and legal frameworks that address AI liability, incident response, and data protection in the context of increasingly capable AI agents.

Ultimately, this evolving threat landscape will drive innovation in AI safety, pushing developers and researchers to build more resilient, secure, and auditable AI systems. The integration of AI into web interactions, while offering immense potential, demands a proactive and multi-faceted approach to security to prevent widespread exploitation.

Original article : decrypt.co