You don't need to hack your AI model if you can hide malicious instructions in the web page that model is going to read for you. That's indirect prompt injection, and by 2026 it's no longer theoretical.
Indirect prompt injection hides covert instructions inside ordinary content — a web page, an email, a code comment — waiting for an AI agent to read it and execute the orders left by whoever hid them. Unlike direct prompt injection (where the attacker talks directly to the model), here the attacker never interacts with the system at all — they just leave a trap somewhere the agent will eventually visit.
A manipulated agent produces a bad action, executed with the permissions you gave it, against systems it already has legitimate access to. That's the key difference: the damage doesn't depend on the attacker breaking through any security barrier — it depends on the agent already having the permission, and the injection simply redirects it toward an unauthorized use of that permission.
The list of real cases is no longer hypothetical: researchers demonstrated "zero-click" data exfiltration from Microsoft 365 Copilot (EchoLeak, CVE-2025-32711); persistent memory poisoning was documented in Amazon Bedrock agents that survives across separate sessions; Palo Alto's Unit 42 reported in December 2025 the first real documented case of malicious indirect prompt injection. Google, monitoring between 2 and 3 billion crawled pages per month, observed a relative 32% rise in malicious activity of this category between November 2025 and February 2026.
The most common vectors are innocent-looking static sites — blogs, forums, comment sections — exactly the kind of content an agent with web-browsing capability visits routinely as part of its normal work. There's no need to compromise a large site: it's enough for the agent to visit it once with the wrong permissions active.
The most effective defense isn't trying to get the model to "recognize" malicious instructions perfectly (it will fail, sooner or later) — it's limiting what an agent can do after reading untrusted content: explicitly separate the content the agent reads from the instructions it can execute, require human confirmation for high-impact actions that originate after processing external content, and treat any data source the agent consumes (web, email, third-party documents) as potentially hostile by default, not neutral.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel