Unit 42 published the first systematic taxonomy of indirect prompt injection (IDPI) attacks observed in the real world. The core finding: any AI agent that reads web content is already being targeted. Attackers embed hidden instructions in ordinary web pages. The web itself becomes a prompt delivery mechanism. This post covers what is happening, what attackers are achieving, and how to design defenses that hold.
What indirect prompt injection is
Direct prompt injection attacks a model through the user's own input. Indirect prompt injection embeds attacker-controlled instructions in content the model reads from an external source: a web page, a document, a search result, a support ticket. The model processes the attacker's text alongside legitimate content and, because LLMs cannot reliably separate instructions from data in a single context, treats it as instructions. The attack scales with the agent's privileges: an agent with access to payments, databases, or backend APIs is a high-value target.
Twenty-two techniques, real victims
Unit 42 identified 22 techniques across three attack components. Delivery: CSS rendering suppression (zero font size, opacity:0, off-screen positioning), HTML attribute cloaking, and JavaScript that decodes and inserts text after page load. Jailbreak: social engineering such as fake developer modes and fake security update framing accounted for 85.2% of observed attempts. Intent: unauthorized transactions (sending $5,000 via a payment platform, subscribing users to paid plans), AI ad-review bypass (the first documented case of its kind), SEO poisoning pushing phishing domains in LLM-driven search results, data destruction (delete database commands, fork bombs), information leakage, and recruitment manipulation. Top delivery methods: visible plaintext (37.8%), HTML attribute cloaking (19.8%), CSS rendering suppression (16.9%). 75.8% of affected pages contained a single injected prompt.
Why this matters for your deployments
If you have deployed any LLM-powered tool that reads external content (a research assistant, an email summarizer, an ad moderation system, an agentic browser, a support ticket classifier), that tool is a potential IDPI vector today. The attacks documented by Unit 42 are operational, not theoretical. The risk scales directly with what the agent can do: a read-only summarizer is a low-severity target; an agent with payment or database write access is critical.
Mitigations that work
Unit 42 recommends spotlighting: separating untrusted web content from trusted instructions using clear delimiters and system-level framing so the model treats fetched content as data, not as instructions. Instruction hierarchy enforcement in newer models provides a second layer, where a system prompt takes precedence over retrieved content. Beyond the model level: intent analysis looking at what the agent is about to do rather than what the prompt says, and behavioral correlation across telemetry, will catch attacks that bypass model-level defenses. Least-privilege agent design, limiting what any single agent can act on, reduces the blast radius of a successful injection significantly.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want help auditing your AI agent deployment for prompt injection exposure.