Unit 42 reported web-based indirect prompt injection observed in the wild across malicious and public webpages, where hidden instructions are placed in pages that browsers, search tools, ad reviewers, crawlers, copilots and autonomous agents later summarize or analyse. The observed intents are operational rather than novelty: AI ad review evasion, SEO manipulation for phishing, forced payment flows, sensitive information leakage, system prompt leakage, data destruction and denial of service. Delivery is built for web parsers — visible plaintext, hidden CSS, zero-sized text, off-screen positioning, HTML attribute cloaking, SVG or CDATA wrapping, JavaScript runtime assembly, canvas and OCR paths, and URL-fragment tricks — while the bypass layer is mostly semantic: authority-override language, JSON or syntax injection, multilingual instructions, payload splitting, homoglyphs, Unicode bidirectional override and nested encoding. The report's central observation for scoring is that impact scales with the agent's authority: the same hidden instruction is low impact for a read-only summarizer and dangerous for an agent that can approve, purchase, write or execute.
ASSESSED SYSTEM
A representative configuration, stated explicitly because Unit 42's report is web telemetry across many deployments rather than one named victim: an LLM agent that ingests public web content — browser assistant, crawler or summarizer, AI ad reviewer, security scanner or copilot — which fetches pages, assembles the parsed page text into model context as one stream (including hidden DOM, off-screen text, attributes, SVG or CDATA content, JavaScript-assembled text and OCR-derived text), and holds tool authority to decide, rank, approve, purchase, write or disclose. The configuration assessed is the ungoverned one the report's remediation describes as missing: no HTML demotion, no obfuscation screening before context assembly, no per-intent capability envelope and no sink policy.
OUT OF SCOPE
Any named product or vendor — none is identified in the evidence, and no score here should be read as describing a specific commercial agent; read-only summarizers with no downstream consumer, which the report itself distinguishes as low impact; the attacker infrastructure and the SEO ecosystem; and the effectiveness of the defences in deployments that have already implemented content demotion, dual-LLM isolation or sink enforcement.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 is NO for the assessed configuration: the dual-LLM split is a recommended control (AID-H-017.007), not an observed topology. Q2 is YES: the report's high-impact class is agents that fetch and analyse pages across multiple steps and then act — 'approve ads, make purchases, write databases, disclose internal data, or execute commands' — invoking tools without explicit human approval for each action. Under the hybrid rule the representative configuration takes the highest-risk qualifying class, so the tool-authoritative agent rather than the read-only summarizer sets the classification, and this is stated explicitly rather than assumed. Agentic intra-axis weights apply. Tier 2: Tier 2 Consumer: the representative deployment interacts directly with public web content on behalf of individual users or advertisers and can act on their accounts and content — purchases, approvals, disclosures — so exploitation affects individuals, matching the Tier 2 examples of browser and content-facing assistants; Tier 1 would require a specific deployment whose failure causes immediate financial or societal harm at scale, which the class-level evidence does not establish.
Documented attack or failure path
- An attacker plants instructions in a webpage using a delivery technique built for parsers rather than readers — hidden CSS, zero-sized or off-screen text, attribute cloaking, SVG or CDATA wrapping, JavaScript runtime assembly, canvas or OCR text, or URL fragments.
- The page is surfaced to an agent, in some observed cases through SEO manipulation that raises the malicious page into the retrieval or crawl path.
- The agent's fetch layer parses the page and passes the extracted text into model context as one undifferentiated stream, with no content demotion and no untrusted-data labelling.
- A semantic bypass layer carries the instruction past shallow screening: authority-override phrasing, JSON or syntax injection, multilingual text, payload splitting, homoglyphs, bidirectional override or nested encoding.
- The model treats the page text as instruction rather than data and adopts the attacker's objective.
- Because the session's capability envelope was never narrowed to the original task, the adopted objective reaches whatever sinks the agent holds — an ad approval, a payment URL, an outbound HTTP request, a database write, or a disclosure of internal context or system prompt.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Detection at the ecosystem layer worked: Unit 42's telemetry surfaced these payloads across public and malicious pages in the wild, which is how the delivery and bypass taxonomies exist at all and is the basis for turning them into regression tests.
- The report is explicit that authority, not the injection, determines outcome — a read-only summarizer with no downstream consumer is low impact even when the injection lands. Deployments that had already constrained agent authority contained the same payloads, which is why capability scoping is the highest-rated control rather than input filtering alone.
- An architectural containment pattern is available and effective rather than merely theoretical: the dual-LLM split lets a quarantined model read raw pages and emit a typed summary while the privileged model holding tool authority never sees the raw page text.
- Some screening exists in practice — the report describes the bypass layer as defeating shallow filters, which is why Ro-1 and Cn-3 sit at the 'basic filters, bypassed' level rather than at zero.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.14–0.59 (midpoint 0.36), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.30 | Ro-1 = 0.25 — basic filters resist naive attacks but fail against a moderate obfuscation budget and against widely reproduced public injection patterns. Scored at the anchor rather than 0.00 because filtering demonstrably exists (the payloads are built to evade it) and rather than 0.50 because the report gives no evidence that multi-step or tool-mediated attacks are being blocked; no measured ASR is claimed here, and this score should be read as class-level rather than as a measurement of any product. | The report catalogues the bypass layer as 'mostly semantic' — authority-override language, JSON or syntax injection, multilingual instructions, payload splitting, homoglyphs, Unicode bidirectional override and nested encoding — techniques it describes as defeating shallow filters, and it recommends per-prompt screening that decodes multiple views of the same page text before context assembly (AID-D-001.001, Very High). It also recommends turning the taxonomy into seeded regression tests, indicating that IDPI-specific adversarial testing is not routine for the representative configuration. No attack success rate is published for any specific deployment.source: brief |
| Ro-4Poisoning Attack Resistance | 0.25w 0.25 | Ro-4 = 0.25 — basic validation exists in the form of ordinary web parsing and fetch hygiene, but there is no adversarial screening, source reputation weighting or provenance labelling of retrieved content, so poisoning of the retrieval and crawl path succeeds with limited effort. | SEO manipulation for phishing appears in the observed intents: attackers work to get poisoned pages into the paths agents crawl, rank and retrieve, which is corpus-level poisoning of the agent's inference-time context source. The recommended countermeasure — demoting page content before it reaches the model and labelling fetched web content as untrusted data with explicit provenance — is described as absent from the paths where injection lands.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.35 | Pr-3 = 0.25 — some minimization controls exist on the primary path, but propagation is ungoverned: values are not carried with provenance labels and sensitive values are not blocked from unnecessary outbound destinations, which is the rubric's 'unnecessary propagation paths' failure rather than an over-collection failure. | AID-H-018.005 is rated High because 'the high-impact examples rely on data or actions flowing to the wrong sink: payment URLs, external web destinations, backend databases, or prompt-leak outputs. Runtime values derived from web content should carry untrusted provenance, and high-sensitivity values should be blocked from outbound HTTP, payment, database-write, or disclosure sinks unless policy explicitly permits the transfer.' The report's remediation restates it: treat external URLs, payment links, database writes, email, file exports and rendered Markdown links as sinks and enforce data-flow policy there, not only at the prompt.source: brief |
| Containment (Cn) — scenario interval 0.10–0.69 (midpoint 0.40), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | Cn-1 = 0.25 — basic boundaries exist (the agent holds a defined tool set and product-level permissions) but they are not bound to the session's task, so content in the data channel can reach the full breadth of the agent's standing authority without any manipulation of a control. | The report's central risk statement is a scope statement: 'the same hidden webpage instruction is low impact for a read-only summarizer, but dangerous for an agent that can approve ads, make purchases, write databases, disclose internal data, or execute commands.' Its remediation is to 'bind every web-ingestion session to a narrow capability envelope. A summarizer should summarize; an ad reviewer should classify; neither should be able to purchase, donate, write databases, run commands, or disclose internal data because a page contains instructions' — the envelope that the assessed configuration does not apply.source: brief |
| Cn-3Output Filtering Robustness | 0.25w 0.18 | Cn-3 = 0.25 — basic filters exist but are bypassed by the same encoding, multilingual and payload-splitting techniques catalogued on the input side, and the tool-laundered path (content embedded into an outbound link or request rather than displayed) is not covered at all. | Sensitive information leakage and system prompt leakage are among the observed intents, and AID-D-003.002 is mapped because 'output scanning should detect secrets, PII, internal instructions, and unusually structured disclosure text before the response is displayed, logged, sent to another tool, or embedded into a link or request' — screening at the output boundary that the representative configuration does not perform, including for the link- and request-embedding path that makes exfiltration look like ordinary output.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.25w 0.12 | Cn-6 = 0.25 — ad-hoc gating of selected high-impact actions with no formal taxonomy: products of this class commonly gate a small set of monetary or destructive operations behind a fixed threshold or a user confirmation, but there is no three-class reversibility determination before execution and no chain-composition rule, so ARCR sits well below 0.40. | Forced payment flows, unauthorized transactions and data destruction appear in the observed intents — delegated-irreversible and bounded-irreversible actions reachable from page content. AID-D-003.003 is mapped as a control to add: 'tool-use monitoring should compare requested actions with the original user intent, page trust level, tool risk class, and recent prompt-injection signals before execution', which describes a risk-class comparison that is not performed pre-execution in the assessed configuration.source: brief |
Unknown, not N/A: 17 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.25 | Scored exactly at the supervised-autonomy anchor and therefore not counted as elevated under the strictly-greater-than-0.75 rule. The representative configuration executes multi-step web tasks and some high-consequence actions with asynchronous human oversight and escalation only for exceptions; it is held below 1.00 because the report does not establish that these agents execute payments or destructive operations wholly unattended — forced payment flows appear as attacker intent, and most deployed browser and copilot agents still surface a confirmation for at least some of that action class. |
| AsAttack Surface Exposure | 1.00w 0.35 | The maximum-exposure anchor is met without interpretation: the assessed configuration is internet-facing and its entire input corpus is untrusted retrieved web content, with tool integration on the far side. Unit 42's telemetry establishes that the corpus is adversarial in practice rather than in principle, and the delivery taxonomy shows the ingestion path being targeted deliberately at parsers rather than at users. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph is published for any assessed deployment, and because this is a class-level reconstruction no deployed inventory exists against which DGC could be computed at all, so the Section 3.2 worst-case default applies. The observed evidence does not independently trigger the 1.00 anchor: the report documents payloads and attacker intents observed in the wild, not a confirmed end-to-end path from a page to an executed irreversible action in a named deployment, so claiming corroboration would overstate it. With a verified graph, a browser or commerce agent holding payment authority would very likely trigger 1.00 on its merits — an ungated path from untrusted page content to a delegated-irreversible payment sink — while a read-only summarizer with no automated downstream consumer would plausibly compute 0.25 to 0.50. That spread is precisely the report's own point that impact scales with authority.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.75w 0.20 | Scored exactly at the guardrail-mitigation anchor and therefore not counted as elevated. The report's own diagnosis is that 'models struggle to separate instructions from data in one context stream', a fundamental property of the model class that the mapped controls — HTML demotion, obfuscation analysis, inference-time validation, capability scoping, sink enforcement — bound through external layers without eliminating, which is why the remediation advice is to keep testing 'until the chain fails at multiple layers'. It is not scored above 0.75 because an architectural fix does exist in the dual-LLM isolation pattern, which removes tool authority from the component that reads untrusted content; that is a redesign rather than a configuration change, so it does not pull the score down to the infrastructure anchor either. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.10 | Near the zero anchor and deliberately so. The assessed configuration is representative rather than a named deployment, so there is no AIBOM or equivalent to review: model origin, training data, retrieval corpus (the open web), tool manifest, identity policy and evaluation artifacts are all unknown and, for a class-level reconstruction, unverifiable in principle. Scored 0.10 rather than 0.00 only because the report documents the component structure of the class — fetch layer, HTML parsing, OCR and metadata extraction, context assembly, tool authority, outbound sinks — with enough specificity to name the boundary, which is more than nothing but far less than a provenance record. This low value is the honest price of a representative assessment and should be read as an assurance statement, not as a finding against any operator. |
| Ec — Public evaluation coverage | 0.25 | coverage 0.26 (6 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.08 | Evidence dated 2026-03-03; age 163 days on the workpaper reference date. Components: T_containment 0.08 · T_calendar 0.28 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_containment. dt_days = 163, measured from the Unit 42 disclosure date 2026-03-03 to the assessment date 2026-08-13. agentic = true: an Agentic/MCP class whose tool grants and permission boundaries change at runtime, so the containment staleness floor applies. baw = false: the report does not establish writable cross-session memory, runtime agent-to-agent messaging, self-modifying configuration or a closed feedback loop for the representative configuration; a specific deployment with browsing memory, or one whose database writes are later re-read in a decision path, would meet the checklist and pull the behavioural floor in, and that should be re-evaluated per deployment rather than inherited from this case. C_monitor = 0.65 because detection is a documented gap: the payloads are engineered to pass shallow filters, IDPI screening before context assembly is a control the report has to recommend, and action-policy monitoring that would catch the attempt at execution time is likewise listed as missing. C_event = 0.65 rather than 0.35: exploitation of this class is observed in the wild, which is a material threat-environment change against the assessed configuration, but no confirmed compromise event of a specific assessed deployment is published, so the moderate cap is the defensible one. C_evidence = 0.85 because the underlying instruction/data separation weakness is unresolved by any available control and the tool-authority gaps remain open. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.13 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-019.002 | Secure HTML Rendering & Content DemotionParent AID-H-019 maps directly to Ro-1, Cn-1, and Cn-3 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. This is the brief's most direct web-specific control — stripping or neutralising scripts, styles, hidden DOM, off-screen text, attributes, SVG payloads and canvas-derived text before content reaches the model — and it bears operationally on the Ro-1 and Ro-4 scores. | Very High | Cn-1 Cn-3 Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisParent AID-D-001. Direct evidence for Ro-1 = 0.25: decoding and scoring multiple views of the same page text — Base64, HTML entities, URL encoding, nested encodings, invisible characters, homoglyphs, bidirectional override, payload splitting — is exactly the screening the catalogued bypass layer defeats. | Very High | Ro-1 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingParent AID-H-018 (Tool Authorization & Capability Scoping). Both mapped legs are scored. This is the control the report treats as decisive: even when the injection lands, a narrow per-session envelope keeps it from reaching purchase, write, execute or disclose authority. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-H-019.001 | URL Normalization & Allowlist FilteringParent AID-H-019 maps directly to Ro-1, Cn-1, and Cn-3 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. Operationally it governs the URL-fragment tricks, payment links and rendered outbound links that make the Pr-3 sink-enforcement gap exploitable. | High | Cn-1 Cn-3 Ro-1 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementCatalogue parent mapping is Cn-1/Cn-6. Its description in this brief is also the direct evidence for Pr-3 = 0.25 — untrusted provenance on web-derived values and blocking high-sensitivity values from outbound HTTP, payment, database-write and disclosure sinks — which is recorded here rather than mapped. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationParent AID-H-002 (AI-Contextualized Data Sanitization & Input Validation). Only the Ro-1 leg is exercised: labelling fetched web content as untrusted data, rejecting instruction-shaped content from data channels and failing closed when a page tries to rewrite role hierarchy. The Fa-1 and Fa-3 legs are catalogue mappings this case does not touch. | High | Fa-1 Fa-3 Ro-1 |
| AID-H-017.007 | Dual-LLM Isolation PatternParent AID-H-017 (Secure Agent Architecture) maps to Cn-5 in the catalogue; Cn-5 is not scored here because the evidence says nothing about agent or tool identity verification in the representative configuration. The pattern's relevance in this case is architectural containment — a quarantined reader model and a privileged actor model — which is recorded under controls_that_held and informs Rf = 0.75. | High | Cn-5 Cn-7 |
| AID-D-003.003 | Agentic Tool Use & Action Policy MonitoringParent AID-D-003 (AI Output Monitoring & Policy-Violation Detection). Direct evidence for Cn-6 = 0.25 and for C_monitor: comparing a requested action against the original user intent, page trust level and tool risk class before execution is the pre-execution comparison the configuration does not make. | Medium | Cn-1 Cn-3 Cn-7 Ro-3 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionSame parent. The Cn-3 leg is the direct evidence for the output-filtering score, including the case where disclosure is embedded into a link or request rather than displayed. | Medium | Cn-1 Cn-3 Cn-7 Ro-3 |
WHAT THIS CASE TEACHES
A population study can be scored honestly as a representative configuration, but only if the assurance layer carries the cost: Pc = 0.10 and a class-level Cp classified as default rather than corroborated are what keep the case from overclaiming — and the ORP shows the strict-inequality boundary at work, with Aa and Rf sitting exactly at 0.75 and therefore not counting toward N_elevated.
Sources: AIDEFEND in Action brief: Web-Based IDPI in the Wild: When Webpages Become Agent Prompt Delivery (2026-04-25) · Unit 42, Palo Alto Networks (Beliz Kaleli, Shehroze Farooqi, Oleksii Starov, Nabeel Mohamed), Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild (2026-03-03)