Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web. The post Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments appeared first on SecurityWeek .

According to the report and related research, attackers used SEO poisoning and malicious websites embedding hidden instructions to perform indirect prompt injection against autonomous AI agents, coercing them into making unauthorized cryptocurrency payments or trusting fraudulent crypto platforms.[1][2][5][7] These campaigns target browsing and DeFi-capable agents whose plugins or connected wallets can execute real financial transactions, demonstrating that prompt-based guardrails alone are insufficient to prevent agent compromise and unauthorized transfers.[5][6] From a RealGround perspective, the practical implication is that any AI agent with transaction, trading, or wallet privileges must be treated as a high-risk fintech surface: enforce least-privilege action-layer controls (spend limits, allowlists, mandatory human approval for payments), cryptographically verify directives, and continuously red-team agents against indirect web-based injections before production use.[3][4][6][7] Organizations should also audit agent business logic and memory handling to ensure that injected instructions from web content cannot persist or propagate across sessions, reducing the likelihood