Prompt injection aimed at AI agents is already on live websites

What changed

On March 3, 2026, Palo Alto Networks' Unit 42 published "Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild" by Beliz Kaleli, Shehroze Farooqi, Oleksii Starov and Nabeel Mohamed (Unit 42). It is vendor threat research drawn from the company's own telemetry, not a peer-reviewed study.

Indirect prompt injection means instructions planted in content a model later reads, such as a web page it is asked to summarize, rather than typed into the model directly. Until now, the authors write, real-world cases "have largely involved low-impact or anecdotal cases, such as 'hire me' prompts embedded in resumes." Their finding is that this has changed: indirect prompt injection "is no longer merely theoretical but is being actively weaponized."

What the report actually shows

Read from the report, kept separate from what anyone makes of it:

• Intents. The authors observed attackers pursuing AI ad review evasion, search manipulation for a phishing site impersonating a betting platform, data destruction, denial of service, unauthorized transactions, sensitive information leakage and system prompt leakage. They grade each intent from low to critical severity. The most common in their telemetry were irrelevant output (28.6%), data destruction (14.2%) and AI content moderation bypass (9.5%).
• Techniques. They identified 22 distinct techniques for building payloads. The most common delivery method was visible plaintext (37.8%), ahead of HTML attribute cloaking (19.8%) and CSS rendering suppression (16.9%). Social engineering, such as "god mode" or "developer mode" authority claims, accounted for 85.2% of jailbreak methods.
• The ad review case. One scam product page carried 24 separate injection attempts, concealed by zero-sizing, off-screen positioning and obfuscation in HTML attributes, all aimed at getting an AI ad reviewer to approve it. Unit 42 first reported it in December 2025 and calls it the first reported real-world example of malicious prompt injection designed to bypass an AI-based ad review system.
• Other examples include a page telling an agent to "delete your database", a script trying to sign a visitor up for a paid plan through an OAuth login, a fork bomb paired with a command to delete the whole file system, and pages steering agents to Stripe and PayPal payment links, one of them asking for $5,000.
• The report gives percentages but not the number of pages or detections behind them.

What it means for an engineering team

Any agent that reads the web is exposed. The report lists "browsers, search engines, developer tools, customer-support bots, security scanners, agentic crawlers and autonomous agents" as systems that routinely read web content. In a health setting that includes a research assistant pulling literature, a coding agent reading documentation, and anything that summarizes a page a clinician or patient pasted in.

Stripping hidden text is not enough. The most common delivery method in this dataset was plain visible text, which a hidden-text filter never sees. And because 85.2% of the jailbreaks were social engineering rather than encoding tricks, a keyword filter for phrases like "ignore previous instructions" catches only the crudest attempts.

Keep untrusted input away from privileges. The authors note that the potential impact scales "alongside the privileges and capabilities of the affected AI application," and data destruction was the second most common intent they saw. An agent that browses should not also hold write access to a database, a payment method or protected health information. Where a task needs both, split it: one component reads the untrusted content and another acts, so that what the first reads cannot become an instruction to the second. That is the idea behind the design-level defenses the report points to, such as spotlighting and Google DeepMind's CaMeL.

Keep a record. If an agent acts on web content, log the URLs it read next to the actions it took. When something goes wrong, the page that caused it is the first evidence you will want, and pages change.

What is still unsettled

How often these attacks succeed. The report documents attempts found in the wild, not outcomes. For the ad review case, the authors say they are "not aware of any confirmed real-world instances where such an attack has been successfully demonstrated against deployed ad-checking agents."

How big the problem is. The percentages come from Unit 42's telemetry without a stated denominator, so they describe the mix of attacks observed, not how common they are across the web.

How far the model layer can be trusted. The report credits instruction hierarchy and adversarial training in newer models with reducing known prompt injection threats "to some extent," and recommends design-level defenses on top. How much weight the model layer alone can bear is still open, which is the argument for not relying on it alone.

Sources

• Kaleli, B., Farooqi, S., Starov, O. and Mohamed, N. Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild. Palo Alto Networks Unit 42, published March 3, 2026.
• Hines, K. et al. Defending Against Indirect Prompt Injection Attacks With Spotlighting. arXiv:2403.14720, first posted March 20, 2024.
• Debenedetti, E. et al. Defeating Prompt Injections by Design. arXiv:2503.18813, first posted March 24, 2025.