Indirect Prompt Injection Attacks Target AI Agents via Web Content

Zscaler researchers have identified a new attack technique targeting AI agents, in which malicious instructions are hidden within web content to manipulate the behaviour of AI systems that retrieve and process information from the internet. Infosecurity Magazine reports that attackers embed prompt-injection text into websites, which is invisible to human users but can be read and executed by AI agents. In documented cases, these hidden prompts instructed AI agents to initiate cryptocurrency payments or perform other unauthorised actions on behalf of the user. The technique exploits the way AI agents process external content, treating instructions found in web pages as legitimate commands rather than untrusted input.

Why this matters for UK organisations

This attack method is particularly relevant for UK organisations deploying AI agents for tasks such as research, content summarisation, customer support, or automated decision-making. If an AI agent retrieves information from a compromised or malicious website, it may execute instructions that were never intended by the user or the organisation. The risk is compounded by the fact that many AI agents operate with elevated permissions or access to sensitive systems, meaning a successful prompt injection could lead to data exfiltration, financial loss, or unauthorised system changes. For organisations experimenting with AI-driven automation, this is a reminder that AI agents require the same level of input validation, access control, and monitoring as any other privileged system component. The attack also highlights a broader challenge, as AI systems become more capable and autonomous, they introduce new attack surfaces that traditional security controls may not address. Organisations need to understand how AI agents interact with external data sources, what permissions they operate with, and how their behaviour can be influenced by untrusted input.

What to review

UK businesses deploying AI agents should review how these systems retrieve and process external content, and ensure that AI agents operate with least-privilege access and appropriate guardrails. Organisations should consider whether AI agent activity is logged and monitored in the same way as other automated systems, and whether security teams understand the risks associated with prompt injection and similar AI-specific attack techniques. It is also worth reviewing whether AI agents have access to sensitive data, financial systems, or administrative functions, and whether those permissions are necessary for the tasks they perform. Organisations should ensure that AI system governance is clearly defined, including ownership of AI security, approval processes for new AI deployments, and procedures for reviewing AI agent behaviour and outputs. Security teams should also consider whether existing security awareness programmes include guidance on AI-specific risks, and whether developers and data scientists understand secure AI development practices. This is a good opportunity to confirm that AI systems are treated as part of the broader technology estate, subject to the same security, monitoring and governance standards as any other business-critical system.

Source: Infosecurity Magazine