{
  "entry": {
    "kind": "vuln",
    "slug": "indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers",
    "name": "indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers",
    "vendor": "Any web-browsing agent able to transact",
    "description": "Zscaler ThreatLabz documented two live campaigns that hide instructions in web pages to steer browsing AI agents, the first confirmed in-the-wild use of indirect prompt injection for direct financial gain rather than research. One posed as documentation for a fake Python library, requests-secure-v2, and told the agent to pay $3 for a developer API key. The other typosquatted debank[.]auction and instructed agents to treat it as the authoritative DeBank domain. Both used SEO poisoning to rank first. Across 26 models tested, 4 executed the fraudulent payment and 2 accepted the typosquatted site as legitimate.",
    "website": "https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-02",
    "risk": {
      "score": 50,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers",
      "aliases": [
        "ti-059"
      ],
      "title": "Indirect Prompt Injection Observed in the Wild: AI Agents Paid Attackers",
      "summary": "Zscaler ThreatLabz documented two live campaigns that hide instructions in web pages to steer browsing AI agents, the first confirmed in-the-wild use of indirect prompt injection for direct financial gain rather than research. One posed as documentation for a fake Python library, requests-secure-v2, and told the agent to pay $3 for a developer API key. The other typosquatted debank[.]auction and instructed agents to treat it as the authoritative DeBank domain. Both used SEO poisoning to rank first. Across 26 models tested, 4 executed the fraudulent payment and 2 accepted the typosquatted site as legitimate.",
      "severity": "medium",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection"
      ],
      "componentType": "agent",
      "component": {
        "name": "Any web-browsing agent able to transact",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat)",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-07-02",
      "modifiedAt": "2026-07-02",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents"
        }
      ],
      "mitigation": "Require human approval for any agent-initiated payment or credential purchase. Never let an agent treat page content as authoritative for domain identity. Restrict which domains a browsing agent may act on, and log agent-initiated transactions separately from user ones.",
      "detectedByAnomity": true
    }
  }
}