2026-07-02 · 2026-Q3
Zscaler Documents In-the-Wild Indirect Prompt Injection Targeting Autonomous AI Agents
Who actually said "do this"?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Attacker
Target
Autonomous web-browsing AI agents; two live malicious-website campaigns observed by Zscaler ThreatLabz
Impact
One campaign used SEO poisoning plus hidden CSS and JSON-LD to impersonate a fake Python package "requests-secure-v2" and push agents to pay a bogus "$3.00 developer API license" plus about 0.0012 ETH to an attacker wallet; a second typosquatted DeBank via "debank[.]auction." In Zscaler's validation across 26 models, four (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro) executed the fraudulent payment and two misclassified the fake site as legitimate
Root cause
Indirect prompt injection: agents ingest and act on hidden instructions embedded in retrieved web content with no boundary between data and instructions
Sources
Catalog
Cite this: AgentProv incident record: Zscaler Documents In-the-Wild Indirect Prompt Injection Targeting Autonomous AI Agents (2026-07-02). https://agentprov.com/incidents/2026-07-02-zscaler-documents-in-the-wild-indirect-prompt-injection-targeting-autonomous-ai
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction