Forcepoint X-Labs Finds 10 Indirect Prompt-Injection Payloads on Live Websites

Summary

Forcepoint X-Labs describes 10 reported indirect prompt-injection payloads on live websites, detailing concealment and spoofing techniques aimed at data theft, fraud, destructive actions, and AI denial of service.

Key points

X-Labs says its active threat hunting identified 10 indirect prompt-injection indicators on publicly accessible websites; the described payloads attempt to influence AI agents that ingest page content.
Reported concealment methods include HTML comments, hidden or tiny text, accessibility attributes, and poisoned metadata.
Examples seek API-key theft, unauthorized payments, data deletion, content suppression, referral manipulation, and altered AI-generated summaries.
Some payloads impersonate system instructions or internal control tokens; others use fake copyright restrictions or conditional instructions aimed at AI systems.
The article warns that simple phrase-matching can flag legitimate security explanations as well as malicious content; it says detection needs to consider context, concealment, and whether instructions are directed at an AI.
X-Labs describes a common attack sequence in which an agent ingests attacker-controlled web content and may act on it; the article documents attempted outcomes, not proof that the listed payloads successfully caused those actions.

Article Details

Attack Vectors: Indirect prompt injection embedded in webpage content, including HTML comments, hidden elements, CSS, accessibility attributes, and metadata.
Payloads target AI agents that browse or summarize pages, index content for RAG pipelines, or process HTML and metadata.
Reported payload objectives include API-key exfiltration, unauthorized shell-command execution and data deletion, financial transactions, content suppression, and referral manipulation.
Defensive Notes: Maintain a strict boundary between untrusted page content and instructions an AI agent is allowed to execute.
Assess detection matches in context; trigger phrases may appear in legitimate security research as well as malicious payloads.
Forcepoint says Real Time Analytics blocks IPI URLs at Stage 3 (Redirect).

Indicators of compromise

Type	Indicator	Context
DOMAIN	`archibase[.]co`	Site listed as an active incident location containing an IPI payload for donation fraud.
DOMAIN	`bentasker[.]co[.]uk`	Site listed as an active incident location where a hidden IPI payload attempted content suppression.
DOMAIN	`faladobairro[.]com`	Site listed as an active incident location where an IPI payload attempted to induce destructive shell-command execution.
DOMAIN	`kassoon[.]com`	Site listed as an active incident location containing a concealed IPI payload for referral and traffic manipulation.
DOMAIN	`kleintechnik[.]net`	Site listed as an active incident location where an IPI payload attempted to redirect an AI agent to an administrative endpoint.
DOMAIN	`lawsofux[.]com`	Site listed as an active incident location containing a visually concealed IPI payload.
DOMAIN	`lcpdfr[.]com`	Site listed as an active incident location where an IPI payload attempted AI behavior suppression.
DOMAIN	`luminousmen[.]com`	Site listed as an active incident location containing a hidden IPI payload for attribution and output manipulation.
DOMAIN	`perceptivepumpkin[.]com`	Site listed as an active incident location containing an IPI payload for an unauthorized payment.
DOMAIN	`thelibrary-welcome[.]uk`	Site listed as an active incident location where an IPI payload sought API-key and sensitive-information exfiltration.