AI Agents Pay Hackers: Indirect Prompt Injection Attacks

Hidden instructions on webpages are now causing AI agents to pay hackers in real-world attacks. Security researchers have documented two live campaigns where AI agents with financial capabilities were targeted. This means an AI assistant could quietly send cryptocurrency to a stranger's wallet without any user confirmation. The attacks use something called indirect prompt injection. This is when an attacker hides instructions inside regular web content, like a webpage or document, that an AI agent then processes. The AI cannot tell the difference between content it should read and instructions it should follow. When an AI agent is linked to tools that handle money, this vulnerability can lead to unauthorized financial transactions. No malware or stolen credentials are needed for these attacks. Prompt injection has been classified as the most critical vulnerability in AI applications. Cybersecurity agencies have also identified it as a persistent and difficult-to-fix threat. This matters because it highlights a significant security risk for anyone using AI agents, especially those connected to financial tools.