Google and Forcepoint Report Real-World Indirect Prompt Injection on Public Websites
Summary
Google and Forcepoint researchers found indirect prompt injection on public websites, including attempts at data theft, destruction and payment fraud. Google reported a 32% rise in malicious activity from November 2025 to February 2026.
Key points
- Google examined crawled public webpages, while Forcepoint X-Labs actively hunted publicly accessible web infrastructure for indirect prompt injection.
- Researchers found payloads concealed in invisible text, HTML comments and page metadata.
- Reported malicious goals included search manipulation, data exfiltration, denial of service, destructive actions and financial fraud.
- One Forcepoint example contained instructions for an AI agent to make a specified PayPal transaction; another used metadata injection to redirect AI-mediated actions toward a Stripe donation link.
- Google reported a 32% relative increase in malicious activity between November 2025 and February 2026.
- Neither team found evidence of sophisticated coordinated campaigns, although Forcepoint said shared templates across domains suggested organized tooling.
- The researchers said risk increases when agents can take privileged actions such as sending email, running commands or processing payments.
Article Details
- Event Type
- Google and Forcepoint researchers reported real-world indirect prompt injection (IPI) attempts embedded in publicly accessible web content.
- Impact
- Reported payloads included attempts at search manipulation, denial of service, data exfiltration, destructive actions, and financial fraud. The article does not report that these actions were successfully completed. Potential impact increases when AI agents can send emails, execute commands, or process payments.
Products
PaypalOne payload, for example, embedded a fully specified PayPal transaction and step-by-step instructions designed for AI agents with integrated payment capabilities.StripeA second case used meta tag namespace injection combined with a persuasion amplifier keyword (“ultrathink”) to route AI-mediated financial actions toward a Stripe donation link.