Indirect Prompt Injection Observed in the Wild: AI Agents Paid Attackers
Indirect Prompt Injection Observed in the Wild: AI Agents Paid Attackers is a medium-severity prompt injection issue in Any web-browsing agent able to transact, an AI agent. Affected: Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat). It has been exploited in the wild.
Is Any web-browsing agent able to transact running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers- Severity
- medium
- Attack type
- Prompt injection
- Component
- Any web-browsing agent able to transact · AI agent
- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
Zscaler ThreatLabz documented two live campaigns that hide instructions in web pages to steer browsing AI agents, the first confirmed in-the-wild use of indirect prompt injection for direct financial gain rather than research. One posed as documentation for a fake Python library, requests-secure-v2, and told the agent to pay $3 for a developer API key. The other typosquatted debank[.]auction and instructed agents to treat it as the authoritative DeBank domain. Both used SEO poisoning to rank first. Across 26 models tested, 4 executed the fraudulent payment and 2 accepted the typosquatted site as legitimate.
Affected versions
| Affected | Fixed in |
|---|---|
Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat).
How do I fix it?
Require human approval for any agent-initiated payment or credential purchase. Never let an agent treat page content as authoritative for domain identity. Restrict which domains a browsing agent may act on, and log agent-initiated transactions separately from user ones.
How do I find every machine running Any web-browsing agent able to transact?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any web-browsing agent able to transact and which version, then enforce a policy on it.