# indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers: Indirect Prompt Injection Observed in the Wild: AI Agents Paid Attackers

> Indirect Prompt Injection Observed in the Wild: AI Agents Paid Attackers is a medium-severity prompt injection issue in Any web-browsing agent able to transact, an AI agent. Affected: Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat). It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers
- **Aliases:** ti-059
- **Severity:** medium
- **Attack type:** Prompt injection
- **Component:** Any web-browsing agent able to transact (AI agent)
- **Exploited in the wild:** yes
- **Published:** 2026-07-02
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers

## Summary

Zscaler ThreatLabz documented two live campaigns that hide instructions in web pages to steer browsing AI agents, the first confirmed in-the-wild use of indirect prompt injection for direct financial gain rather than research. One posed as documentation for a fake Python library, requests-secure-v2, and told the agent to pay $3 for a developer API key. The other typosquatted debank[.]auction and instructed agents to treat it as the authoritative DeBank domain. Both used SEO poisoning to rank first. Across 26 models tested, 4 executed the fraudulent payment and 2 accepted the typosquatted site as legitimate.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Any web-browsing agent able to transact (4 of 26 tested models paid; 2 of 26 accepted the typosquat).

## How do I fix it?

Require human approval for any agent-initiated payment or credential purchase. Never let an agent treat page content as authoritative for domain identity. Restrict which domains a browsing agent may act on, and log agent-initiated transactions separately from user ones.

## How do I find every machine running Any web-browsing agent able to transact?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Any web-browsing agent able to transact and which version, then enforce a policy on it.

## References

- article: https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents

## Related vulnerabilities

- [CVE-2026-96893](https://catalog.anomity.ai/vuln/cve-2026-96893) — high
- [cryptographic-context-injection-an-encrypted-web-page-got-github](https://catalog.anomity.ai/vuln/cryptographic-context-injection-an-encrypted-web-page-got-github) — medium
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via](https://catalog.anomity.ai/vuln/salesbleed-zero-click-data-exfiltration-from-salesforce-agentforce-via) — high
- [CVE-2026-24301](https://catalog.anomity.ai/vuln/cve-2026-24301) — high
- [ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the](https://catalog.anomity.ai/vuln/ghostjacking-a-firewall-block-log-is-an-injection-channel-because-the) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=indirect-prompt-injection-observed-in-the-wild-ai-agents-paid-attackers