Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild
Summary: Unit 42 reports in-the-wild detections of web-based indirect prompt injection, including what it calls the first reported real-world case of malicious IDPI designed to bypass an AI-based product ad review system, hosted at reviewerpress[.]com and serving a scam advertisement for military glasses. The researchers identified 22 distinct techniques attackers used to build payloads, and found one page containing 24 separate prompt injection attempts hidden through visual concealment, obfuscation, runtime DOM insertion and jailbreak-style phrasing.
Bottom line: The web itself now functions as a prompt delivery mechanism: a single malicious page can steer LLM behavior across many users, and the impact scales with whatever privileges the consuming agent holds. Unit 42 also notes it is not aware of any confirmed real-world instance where such an attack has been successfully demonstrated against deployed ad-checking agents.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026