Practical guides to protect yourself, your family, and your business from AI-driven scams, deepfakes, and emerging cyber threats.
Popular articles
Your AI agent read a web page, and the web page told it to pay a stranger
A research team at Zscaler built a fake software documentation page, hid a few lines of text inside it that no human visitor would ever see, and pointed autonomous AI agents at it. Four out of twenty-six AI models read the hidden text, believed it, and sent cryptocurrency to a wallet the researchers controlled. No human approved the payment. The agents did it on their own, because a page they were reading told them to.
This is not a lab curiosity. Zscaler found the technique already running in the wild, on real sites tuned to be discovered by exactly the kind of AI assistant a developer now trusts to browse the web and get work done. The lesson underneath is uncomfortable. The moment you let an agent read the open internet and act on what it finds, the web page becomes the attacker.
What happened
On July 2, 2026, Zscaler's ThreatLabz research team documented two live campaigns using a technique called indirect prompt injection. The phrase describes a simple, potent trick. Instead of attacking an AI model directly, you plant instructions inside content the model will read, such as a web page, and the model treats those instructions as if they came from its own user. The attacker never touches the agent. They only have to poison what the agent looks at.
The first campaign posed as documentation for a Python library called requests-secure-v2. The visible page looked like ordinary developer docs. The payload sat in two places a person would not notice: text pushed off the edge of the screen with CSS (the styling code that controls where things appear on a page), and JSON-LD metadata, which is machine-readable data that search engines and AI tools read as trusted background about a site. That hidden layer told any AI agent working on a coding task that it had to buy a three dollar API license key, roughly 0.0012 ETH (a small amount of the cryptocurrency Ether), to clear a fake error, then walked it through paying a hardcoded crypto wallet. To make sure an agent would find the page in the first place, the attackers used SEO poisoning, gaming search rankings so their trap sat near the top of the results. A second campaign used a lookalike domain impersonating DeBank, a popular cryptocurrency portfolio tracker, with hidden text ordering agents to treat the fake as the real, authoritative site.
- Across 26 large language models (the AI systems behind assistants like ChatGPT and Gemini), four were manipulated into actually executing the fraudulent payment, including versions of Meta's Llama and Google's Gemini.
- The same documentation site also tried to defraud human developers, so the AI agent was simply a new victim bolted onto an existing scam.
- In the DeBank test, two models wrongly trusted the fake site, but only when they had no genuine reference to compare against. Given the real DeBank alongside it, none were fooled.
Why it matters
The concrete result is small in dollars and large in what it proves. A stranger's hidden sentence made commercial AI models move money with no human in the loop. For your organization, the exposure grows the moment an agent holds two capabilities at once: the ability to browse the open web and the ability to take an action that costs something, whether that is a payment, a credential, or a command. If your developers let an assistant fetch and follow documentation, its search results are now part of your attack surface, and a page it reads can quietly become a page that instructs it. The wider shift is the one to carry into a meeting. Security has spent years teaching humans to distrust what they read online. Agents were handed the opposite instinct, which is to read the page, trust the page, and act on the page. Zscaler's own finding points to the single control that held, and that is grounding. The models given a trusted reference to check against were not fooled, while the ones reading a strange page in isolation were. As the company put it, web content itself is "going to become a larger attack surface."
What to do about it
- Never give a browsing agent standing permission to spend or move anything. Require a human to approve any payment, transfer, or credential use, because this entire attack collapses if the agent cannot complete the transaction by itself.
- Ground agents against a trusted allowlist for anything sensitive. Give them a known-good list of payment destinations, package sources, and vendor domains, because in Zscaler's tests the models that could compare a suspect page against a real reference did not fall for the fake.
- Treat everything an agent reads from the open web as untrusted data, not commands. Isolate the browsing context and flag or strip instruction-like text in fetched content, because indirect prompt injection works precisely by smuggling orders into material the model was told to trust.
Bottom line
No malware ran here, and no password was stolen. An attacker wrote a few invisible lines on a web page, made sure an AI agent would find it, and let the agent's own helpfulness do the rest. That is the shape of the threat as we hand more real-world authority to systems that read the internet and act without pausing to doubt it. Before you let an agent loose on the web with any power to spend, ask the question this research answers plainly: if a page it visits tomorrow tells it to send money, what in our setup would stop it, and would the agent even think to ask?
