Unit 42 Details In-the-Wild Web-Based Prompt Injection Attacks Against AI Agents

Summary

Unit 42 reports in-the-wild web-based indirect prompt injection (IDPI), identifying 22 payload techniques and intents including ad-review evasion, data destruction and unauthorized transactions; successful bypass of deployed ad-review agents was not confirmed.

Key points

Unit 42 reports observing web pages with hidden or manipulated instructions that LLMs and AI agents may interpret as commands.
Researchers identified 22 payload-engineering techniques across prompt delivery and jailbreak methods, including visual concealment, HTML attribute cloaking and dynamic execution.
The reported top attacker intents were irrelevant output (28.6%), data destruction (14.2%) and AI content-moderation bypass (9.5%).
A detected prompt targeted an AI ad-review system with a scam advertisement; researchers said they knew of no confirmed successful attack against a deployed ad-checking agent.
Other observed prompts attempted database deletion, denial of service, unauthorized transactions, sensitive-information leakage and SEO manipulation; these were reported attempts, not confirmed outcomes.
Social engineering accounted for 85.2% of observed jailbreak methods; visible plaintext was the most common delivery method at 37.8%.
Recommended defenses include separating untrusted web content from instructions, analyzing attacker intent and correlating behavior beyond simple pattern matching.

Article Details

Attack Vectors: Attackers embedded hidden or manipulated instructions in webpages that LLMs or AI agents later ingested during tasks such as summarization, analysis, or automated review.
Reported delivery methods included visually concealed text, HTML attributes, SVG/CDATA, visible plaintext, and JavaScript that assembled prompts at runtime.
Reported prompt-evasion methods included invisible characters, homoglyphs, payload splitting and encoding, multilingual instructions, syntax injection, and social-engineering-style authority or persona claims.
Defensive Notes: Use web-scale detection to identify injected prompts, assess their visibility and intent, and correlate behavior across telemetry rather than relying only on pattern matching.
Separate untrusted webpage content from trusted instructions, including through spotlighting; the article also notes instruction hierarchy and adversarial training as defenses.
Palo Alto Networks identified Advanced URL Filtering, Advanced DNS Security, Advanced Web Protection, Prisma Browser, and Prisma AIRS as protection resources.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`1winofficialsite[.]in`	Page containing visible prompt text intended to promote a phishing site through SEO manipulation.
DOMAIN	`cblanke2[.]pages[.]dev`	Page containing prompts that attempt filesystem deletion and a fork bomb to cause denial of service.
DOMAIN	`dylansparks[.]com`	Page containing a prompt intended to make an AI agent disclose sensitive information.
DOMAIN	`myshantispa[.]com`	Page reported to contain a prompt attempting to manipulate AI-generated reviews in favor of a spa business.
DOMAIN	`perceptivepumpkin[.]com`	Page associated with an injected prompt attempting to redirect a viewer to send $5,000 to an attacker-controlled account.
DOMAIN	`reviewerpressus[.]mycartpanda[.]com`	Destination reached from the scam advertisement’s Buy Now button.
DOMAIN	`runners-daily-blog[.]com`	Page containing an injected prompt attempting to make an AI agent purchase running shoes.
DOMAIN	`shiftypumpkin[.]com`	Page associated with an injected prompt attempting to redirect a viewer to send $5,000 to an attacker-controlled account.
DOMAIN	`splintered[.]co[.]uk`	Page containing a prompt attempting to make an AI agent delete its database.

Vendors

Palo Alto Networks(spotlighting), intent analysis, and behavior-based correlation beyond simple pattern matching; Palo Alto Networks products and Unit 42 services are cited as mitigation resources.

Products

Advanced DNS Securityand investigate IDPI attacks to better protect customers from them via Advanced URL Filtering, Advanced DNS Security, and Advanced Web Protection on Prisma Browser and Prisma AIRS.Advanced URL Filteringwill continue to monitor and investigate IDPI attacks to better protect customers from them via Advanced URL Filtering, Advanced DNS Security, and Advanced Web Protection on Prisma Browser and Prisma AIRS.Advanced Web Protectionto better protect customers from them via Advanced URL Filtering, Advanced DNS Security, and Advanced Web Protection on Prisma Browser and Prisma AIRS.Prisma AIRSvia Advanced URL Filtering, Advanced DNS Security, and Advanced Web Protection on Prisma Browser and Prisma AIRS.Prisma browsercustomers from them via Advanced URL Filtering, Advanced DNS Security, and Advanced Web Protection on Prisma Browser and Prisma AIRS.