Executive Summary
Unit 42 documents live web-based indirect prompt injection, where hidden instructions on websites affect AI agents summarizing or analyzing pages, driving unauthorized actions or data exfiltration.
What Happened
Unit 42 documents live cases of web-based indirect prompt injection, where attackers embed hidden instructions in websites that are later ingested by AI agents performing tasks like webpage summarization or content analysis.[2] The research shows that when such agents have tool or data access, these attacks can drive unauthorized actions, data exfiltration, or other real-world impacts without the user directly entering a malicious prompt.[2]
Vulnerability / Attack Technique
Web-based indirect prompt injection in the wild
Technical Mechanism
Websites carry hidden instructions that agents ingest during routine tasks.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Observed in the wild, not just in labs. RealGround analysis: agents that summarize web pages should not hold sensitive access.
Recommended Controls
- Separate web-reading agents from agents with sensitive access
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
Palo Alto Networks Unit 42: https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.