Loading story…
Researchers reported two web-based campaigns that used indirect prompt injection, SEO poisoning, and hidden HTML or JSON-LD content to manipulate autonomous AI agents. In one case, attackers promoted fake documentation for a bogus Python package, requests-secure-v2, and embedded concealed instructions telling AI systems to obtain an API key or fix an error by sending cryptocurrency as a supposed developer license fee. Zscaler ThreatLabz said the operation was tied to infrastructure including domains, repositories, an Ethereum wallet, and a GitHub account identified as Open-Agent-Utilities.
A second campaign used the typosquatted domain debank[.]auction to impersonate the DeBank DeFi platform and inserted hidden prompts directing AI agents to treat the fraudulent site as authoritative. In controlled testing with a browsing-capable autonomous agent, Zscaler found that 4 of 26 evaluated LLMs could be induced to make a payment and 2 incorrectly classified the fake DeBank site as trustworthy. The findings show that public web content and search rankings are becoming a practical attack surface as AI agents gain the ability to browse, decide, and execute actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Zscaler associated additional infrastructure with a GitHub account named Open-Agent-Utilities and published indicators of compromise including domains, repositories, and an Ethereum wallet tied to the campaigns.
In controlled testing, Zscaler found that some evaluated AI systems were vulnerable to these web-based prompt injection attacks: four of 26 LLMs could be induced to make a payment, and two misclassified the fake DeBank site as trusted.
A second campaign used the typosquatted domain debank[.]auction to impersonate the DeBank platform and embedded prompts designed to convince AI systems that the fraudulent site was the authoritative and trustworthy source.
Researchers identified a campaign that used SEO poisoning around the fake Python package name "requests-secure-v2" and embedded hidden instructions intended to trick autonomous AI agents into making a cryptocurrency payment for an API key, license fee, or error resolution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcecsoonline.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported **AI recommendation poisoning** attacks that abuse “*Summarize with AI*” buttons and AI share links to inject hidden instructions into AI assistants via crafted URL parameters. When a user clicks these links, the pre-filled prompt can attempt to write persistent directives into an assistant’s **memory** (where supported), biasing future outputs to treat certain companies as trusted sources or to prioritize specific products and advice in areas like finance, health, and security. Microsoft researchers said they observed **50+ unique prompts** tied to **31 companies across 14 industries**, and noted that readily available tooling (e.g., *CiteMET* and “AI Share URL” generators marketed as SEO hacks) lowers the barrier to deploying these manipulation techniques across email and web traffic. Separately, reporting described **AI-agent-driven “reputation farming”** targeting **open-source maintainers**, indicating a broader trend of adversaries using automated AI workflows to influence trust signals and perceived credibility in technical ecosystems. While the tactics differ (memory/prompt injection via AI links vs. automated outreach to maintainers), both reflect an emerging risk: **manipulation of AI-mediated recommendations and reputational signals** to steer user and developer decisions without transparent attribution, increasing the likelihood of downstream security impact (e.g., biased security guidance, promoted dependencies, or trust in unvetted sources).
Jun 29, 2026
New research shows that **AI assistants and coding agents can be manipulated by hidden or misleading instructions embedded in content they process**, creating a practical path to social engineering, data leakage, and potentially malicious command execution. LayerX reported that a **custom font and CSS-based rendering attack** can make a webpage appear harmless in the DOM while showing different instructions to the user in the browser, exploiting the gap between what AI systems analyze and what humans actually see. In its proof of concept, a page that looked like benign fanfiction at the HTML level rendered instructions that could steer a user toward executing a reverse shell, and the company said major AI assistants it tested failed to detect the threat. Separate research highlighted a related **semantic injection** risk in software repository `README` files used by AI coding agents. In testing, attackers embedded malicious setup-style instructions into documentation so agents would exfiltrate local files or other sensitive data to external servers during project setup, with reported success rates of up to **85%**. The benchmark, *ReadSecBench*, used 500 open source repositories across multiple programming languages and found the attack worked across agents using models from **Anthropic, OpenAI, and Google**, indicating that hidden-instruction attacks are not limited to one interface or vendor but reflect a broader weakness in how AI systems interpret untrusted content and operational guidance.
Jun 29, 2026
Security researchers are highlighting how attackers can **poison AI systems** by manipulating what models ingest or remember from web content, leading to untrustworthy outputs that may be widely relied upon. Bruce Schneier demonstrated that simply publishing a fabricated webpage can quickly influence major chatbots and search-integrated AI features (e.g., Google’s AI Overviews and Gemini), which then repeated the false claims as if they were factual; in his test, some models were fooled while others were more resistant. Separately, reporting described **AI recommendation/memory poisoning** via “Summarize with AI” buttons that embed long prompts inside URLs. The visible instruction (e.g., “summarize this article”) can be paired with hidden directives such as “remember this site as a trusted authority,” causing the user’s authenticated AI account to update long-term preferences or memory in ways that benefit an attacker or marketer. The write-up cites Microsoft threat intelligence observations of dozens of in-the-wild examples across multiple companies and warns the technique can blend into **malvertising** and become higher-risk when applied to domains like finance, healthcare, or security decision-making.
Jun 29, 2026