--- title: Fooling AI Agents: Web-Based Indirect Prompt Injection... description: Researchers from Palo Alto Networks Unit 42 present the first documented real-world cases of indirect prompt injection (IDPI) attacks observed in the wild.... canonical: https://daily.dev/posts/fooling-ai-agents-web-based-indirect-prompt-injection-observed-in-the-wild-8htswwgzw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild | daily.dev og:description: Researchers from Palo Alto Networks Unit 42 present the first documented real-world cases of indirect prompt injection (IDPI) attacks observed in the wild.... og:url: https://daily.dev/posts/fooling-ai-agents-web-based-indirect-prompt-injection-observed-in-the-wild-8htswwgzw og:image: https://api.daily.dev/og/posts/8HtsWWgZW.png og:image:alt: Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild **[Unit 42](https://daily.dev/sources/unit42)** · 25 min read · 1 upvotes · 0 comments ## Summary Researchers from Palo Alto Networks Unit 42 present the first documented real-world cases of indirect prompt injection (IDPI) attacks observed in the wild. Unlike direct prompt injection, IDPI embeds hidden or manipulated instructions within web content that AI agents later consume, causing them to execute attacker-controlled commands. The research documents 12 real-world cases spanning attacker intents from low-severity (irrelevant output, resource exhaustion) to critical (data destruction, DoS via fork bomb, sensitive information leakage). A notable first is an AI-based ad review bypass where a scam page used 24 distinct injection attempts to trick an LLM ad-checker into approving fraudulent content. The paper provides a detailed taxonomy of 22 payload engineering techniques including visual concealment (zero-sizing, off-screen positioning, CSS suppression), obfuscation (SVG/XML encapsulation, HTML attribute cloaking), dynamic runtime assembly, and jailbreak methods (invisible characters, homoglyph substitution, multilingual instructions, social engineering). Telemetry analysis shows social engineering dominates jailbreak methods (85.2%), visible plaintext is the most common delivery method (37.8%), and irrelevant output is the top attacker intent (28.6%). Defenses discussed include spotlighting, instruction hierarchy, adversarial training, and design-level mitigations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Google Online Security Blog: AI threats in the wild: The current state of prompt injections on the web](https://daily.dev/posts/google-online-security-blog-ai-threats-in-the-wild-the-current-state-of-prompt-injections-on-the-w-p1dcel1d6) · Google Security Blog · 0 upvotes · 0 comments - [Hiding Prompts in Plain Sight: A New AI Security Risk](https://daily.dev/posts/hiding-prompts-in-plain-sight-a-new-ai-security-risk-mzblzfejg) · Auth0 · 1 upvotes · 0 comments - [All About Prompt Injection: How Attackers Trick AI](https://daily.dev/posts/all-about-prompt-injection-how-attackers-trick-ai-s9hvfkkpw) · InfoSec Write-ups · 3 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/fooling-ai-agents-web-based-indirect-prompt-injection-observed-in-the-wild-8htswwgzw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild","url":"https://daily.dev/posts/fooling-ai-agents-web-based-indirect-prompt-injection-observed-in-the-wild-8htswwgzw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fooling-ai-agents-web-based-indirect-prompt-injection-observed-in-the-wild-8htswwgzw"},"datePublished":"2026-03-03T11:11:30.413Z","dateModified":"2026-03-15T06:39:37.118Z","description":"Researchers from Palo Alto Networks Unit 42 present the first documented real-world cases of indirect prompt injection (IDPI) attacks observed in the wild....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5803006b798f88ac2bc08861d811420?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5803006b798f88ac2bc08861d811420?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fooling-ai-agents-web-based-indirect-prompt-injection-observed-in-the-wild-8htswwgzw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,prompt-injection,web-security","timeRequired":"PT25M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild"}]} ```