Two distinct campaigns leverage indirect prompt injection attacks embedded in malicious websites to exploit autonomous AI agents with web-browsing and payment capabilities. The first campaign uses SEO poisoning targeting AI agents searching for the Python library requests-secure-v2, embedding hidden prompts instructing the agent to make payments encoded in schema markup and hidden HTML elements. The second campaign involves typosquatting a decentralized finance portfolio tracker (DeBank) website, using keyword stuffing and metadata to impersonate the legitimate service and mislead AI agents. Testing showed that several large language models were successfully manipulated into making payments or misclassifying fraudulent sites as legitimate. These attacks exploit AI agents' interpretation of web content, expanding the attack surface as AI becomes more integrated with web interactions.

The campaigns can cause autonomous AI agents to execute unauthorized cryptocurrency payments and trust fraudulent cryptocurrency platforms. This may lead to financial losses and undermine trust in AI-driven web interactions. The attacks specifically target AI agents with web browsing and payment execution capabilities, potentially causing them to perform unintended actions based on manipulated web content. Human users may also be targeted by displayed payment options on malicious sites. No evidence of widespread exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations using autonomous AI agents with web browsing and payment capabilities should monitor vendor advisories for updates. Mitigations may include restricting AI agents' ability to execute payments autonomously, validating web content sources, and improving AI models to detect and ignore prompt injection attempts. Since no official fixes are currently documented, cautious deployment and monitoring of AI agents in sensitive workflows is advised.