The web now carries instructions for your AI

An AI agent that reads the web for you reads everything on the page, including what you can’t see. A line of white text on a white background, an HTML comment, a hidden tag: to a person they are invisible, to a language model they are words like any others. Some of those words are now written for the model.

This is indirect prompt injection. Instead of tricking the AI directly, the attacker leaves instructions where the AI will find them, in a web page, an email, a document or a code comment, and waits for an agent to read them while working for someone else. OWASP, the security standards body, ranks prompt injection first among the risks of AI applications.

What is out there

In April 2026, Google scanned billions of public web pages each month for instructions aimed at AI. Most of what it found was harmless: pranks, advice to AI readers, search-ranking tricks, and sites trying to keep AI away. A small number tried to steal data or delete files. Malicious detections rose 32 percent between November 2025 and February 2026. Google’s summary was measured: “We did not observe significant amounts of advanced attacks,” and it expects them to grow more sophisticated.

The same month, Forcepoint’s researchers published ten live payloads they had caught. Hidden in comments, invisible styling and metadata, they asked an AI to leak API keys, run a command to delete backups, push a donation through Stripe, and send $5,000 through PayPal. Unit 42 had already documented twelve cases and 22 ways of building such payloads, including the first attempt it had seen to fool an AI that reviews ads, with 24 separate injections on a single page.

Both firms are careful about one thing. They saw the instructions; they did not see them succeed. Unit 42 says it has limited visibility into whether payloads work, and Forcepoint reports no execution or loss.

When researchers tried it

In controlled tests, the attacks work. Researchers have shown it again and again against the products of the largest companies, and each was fixed after being reported.

• EchoLeak, 2025: one crafted email made Microsoft 365 Copilot send data from the user’s context to an outsider, with no click needed. Found by Aim Security, rated 9.3 out of 10, fixed by Microsoft, with no evidence it was exploited.
• Perplexity’s Comet browser, 2025: Brave’s researchers hid an instruction in a Reddit comment that made the browser read the user’s email address and a one-time login code and post them back, enough to take over an account. Brave later said the first fix was not complete.
• Comment and Control, 2026: researchers showed that a pull request title or an issue comment could make AI coding agents running in GitHub Actions, from Anthropic, Google and GitHub, leak their secret keys. All three were reported and resolved.

Brave drew the general lesson: “traditional Web security assumptions don’t hold for agentic AI.” A browser has spent thirty years keeping one site from touching another. An agent that reads one site and acts on another tears that wall down by design.

When it cost real money

In May 2026 the instructions found something to act on. An attacker gave a wallet run by Bankr, tied to the Grok account on X, a membership token that unlocked transfers. Then they posted a message in Morse code that Grok decoded into a reply addressed to Bankr’s own bot, which sent tokens worth roughly $150,000 to $200,000. Bankr’s founder wrote that Grok “got hit with a prompt injection. someone tricked it into using my transfer tool.” Most of the money was returned after negotiation, and Bankr changed its bot so it no longer acts on replies on X.

The lesson is not that one model was gullible. Two automated systems trusted each other, one could move money, and nobody had to approve the move.

Why it won’t be patched away

The companies building these agents say openly that this cannot be fixed once and for all. OpenAI, writing about its Atlas browser in December 2025: “Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’.” The UK’s National Cyber Security Centre has said it may never be totally mitigated. An agent useful enough to read your inbox and act on it will always read things written by people who are not you.

Building agents that don’t take orders from strangers

If the injection can’t be stopped from arriving, the defence is to make sure it can’t do much when it does. The sources agree on the shape of that.

• Treat everything an agent reads as data, never as a command, and keep the person’s request separate from what the page says.
• Give the agent the least it needs: allowlist its tools, and keep secrets and write access out of its reach.
• Put a person in front of anything consequential: sending, paying, deleting, changing access.
• Check every action the agent proposes against what the person actually asked for.
• Don’t let one automated system act on another’s word without a check in between.
• Keep testing your own agents with hostile pages, because the techniques change every month.

None of this makes an agent less useful. It makes it trustworthy enough to give real work to, which is the only kind of useful that matters inside a company.