Researchers Documented Indirect Prompt Injection Planted in Web Content

Security researchers documented web-based indirect prompt injection occurring in the wild: content published on the open web containing instructions intended to be read and acted on by AI agents browsing it on a user’s behalf.

Direct prompt injection requires the attacker to talk to the model — which means having access to the interface, and generally attacking their own session.

Indirect injection requires only that the attacker publish something the agent will eventually read. A page, a document, a review, a support ticket, an email. The attacker never touches the target, does not need to know who the target is, and can wait.

It converts prompt injection from a curiosity about model behaviour into a deployable technique against strangers, which is precisely the transition that took this from research to the corpus.

A person reading a hostile web page is not compromised by reading it. Human reading is not execution — the browser sandbox enforces that separation, and decades of security engineering went into it.

An agent reading the same page is deciding what to do next partly on the basis of what the page says. Retrieval is not a neutral act, and the boundary the browser spent twenty years establishing does not apply above it.

Nothing anomalous happens on the network. The agent fetches a page it was asked to fetch, over an ordinary connection, and then takes actions it is authorised to take. Every log entry is unremarkable.

It is the same detection problem as the stolen key material at 25-0723 and the recruited insiders at 25-0514: authorised activity, wrong purpose, no signature. Graded medium — the technique is documented by researchers, and this desk cannot establish scale or victim counts.