Web-Based Indirect Prompt Injection Observed in the Wild
Unit 42 documented the first real-world web-based indirect prompt injection attack on an AI agent. An attacker hid instructions on a third-party site, causing the financial research agent to follow malicious commands instead of the user's original request.
Background
- Palo Alto Networks' Unit 42 is a major cybersecurity research team that analyzes threats. This report documents the first confirmed real-world attack using **indirect prompt injection** against an AI agent.
- **Indirect prompt injection** is an attack where malicious instructions are hidden in data (e.g., web pages, emails, PDFs) that an AI agent reads, rather than typed directly by a user. The AI then unwittingly follows those instructions—e.g., exfiltrating private data or running unauthorized actions.
- The attack targeted an enterprise AI agent that browses the web to answer user questions. The attacker poisoned a public web page with hidden text; when the agent fetched that page, it was tricked into performing unintended actions.
- This matters because it moves prompt injection from theory to a live, exploitable threat against companies deploying AI agents with web access, and highlights that current defenses are still immature.