Researchers found two live scam campaigns that hide instructions in web pages to manipulate autonomous AI agents, including one that got some agents to initiate cryptocurrency payments and another that made some models trust a fake DeBank site. Zscaler says the first campaign used search-result poisoning and fake API documentation for a bogus Python package, with hidden prompts in schema markup and HTML telling agents to pay for an API key; the second used typosquatting and search optimization to impersonate DeBank. In tests across 26 large language models, four executed a payment and two misidentified the fake site as legitimate.
Why it matters: Organizations experimenting with AI agents that can browse the web or make transactions could have those agents manipulated by hostile content. Treat web content as untrusted input for AI agents, restrict payment and external-action permissions, and add human approval before any financial or account-trust decision.
Ionut Arghire
2026.07.06
100% relevant
This article establishes a distinct security story around in-the-wild prompt-injection scam campaigns targeting autonomous AI agents, not just a lab demonstration or a previously tracked flaw.
← Back to all stories