This campaign targets AI agents by leveraging indirect prompt injection (IPI) through web content. Attackers embed hidden instructions in JSON-LD and CSS-concealed content within fake API documentation to coerce AI agents into making unauthorized payments via Stripe or cryptocurrency. Another campaign uses typosquatting to impersonate the DeBank cryptocurrency portfolio tracker, embedding hidden prompts that cause AI models to misclassify the fraudulent site as legitimate. Testing across 26 LLMs revealed vulnerabilities in multiple models, demonstrating measurable real-world impact of these manipulations.

The campaigns can cause AI agents to execute fraudulent payment transactions and misclassify malicious sites as legitimate, potentially leading to financial loss and trust erosion in AI-driven workflows. Four tested LLMs were vulnerable to the payment scam, and two misclassified the typosquatting site, indicating a tangible risk to AI systems relying on web content for decision-making.

No official patches or fixes are currently available for this type of indirect prompt injection targeting AI agents. Mitigation involves awareness of these attack techniques and cautious validation of AI agent outputs, especially when they involve financial transactions or trust decisions based on web content. Monitor updates from AI model vendors and security researchers for potential defenses or model improvements addressing IPI attacks.