Overview
Researchers have uncovered two active campaigns leveraging indirect prompt injection attacks against autonomous AI agents to coerce them into executing cryptocurrency payments without user authorisation. The attacks embed malicious instructions within web content that AI agents encounter during browsing tasks, effectively hijacking agent behaviour at the point of content ingestion. This marks a significant escalation in the practical threat posed by prompt injection — moving beyond data exfiltration or misinformation into direct, financially damaging action.
As agentic AI deployments proliferate — with LLM-powered systems increasingly granted access to wallets, APIs, and real-world tooling — the attack surface for this class of exploit expands rapidly.
Technical Analysis
Indirect prompt injection differs from direct injection in that the attacker does not interact with the model directly. Instead, malicious instructions are embedded in third-party content — in this case, websites — that an AI agent retrieves and processes as part of a legitimate task.
When the agent browses a malicious page, the hidden payload (often concealed in HTML comments, invisible text, or metadata) is parsed by the LLM as part of its context window. The injected instructions override or augment the agent’s original directives, instructing it to initiate a crypto transfer to an attacker-controlled wallet address.
Two distinct campaigns were observed, suggesting either different threat actors or deliberate variation in delivery mechanism to test detection evasion. The campaigns exploited the inherent trust AI agents place in retrieved web content when it enters the context window without sanitisation or privilege separation.
Framework Mapping
MITRE ATLAS:
- AML.T0051 – LLM Prompt Injection: Core technique; indirect injection via adversarial web content.
- AML.T0043 – Craft Adversarial Data: Attackers deliberately crafted web content to manipulate agent reasoning.
- AML.T0047 – ML-Enabled Product or Service: The targeted systems are production agentic AI deployments with real-world tool access.
OWASP LLM Top 10:
- LLM01 – Prompt Injection: Direct classification of the attack vector.
- LLM08 – Excessive Agency: Agents with payment capabilities acting on unverified instructions exemplify this risk.
- LLM02 – Insecure Output Handling: Downstream execution of injected commands without validation.
Impact Assessment
The immediate financial impact is the most concrete harm: funds transferred to attacker wallets are typically unrecoverable given the irreversible nature of blockchain transactions. Beyond direct theft, these campaigns demonstrate proof-of-concept for a broader class of agentic compromise — any tool-enabled AI agent (email senders, API callers, code executors) is potentially susceptible to equivalent redirection attacks.
Organisations trialling agentic AI for finance, operations, or customer service automation face the highest near-term exposure. Consumer-facing AI assistants with payment integrations represent a secondary risk surface.
Mitigation & Recommendations
- Require explicit human approval for all financial actions initiated by AI agents, regardless of apparent legitimacy.
- Implement content sanitisation pipelines that strip or flag potentially injected instructions from retrieved web content before LLM processing.
- Apply least-privilege principles to agent tool access — revoke payment and wallet API permissions unless operationally essential.
- Use prompt privilege separation techniques to distinguish between trusted system instructions and untrusted external content.
- Monitor agent action logs for anomalous or unexpected transaction attempts and establish alerting thresholds.
- Red-team agentic deployments specifically against indirect injection scenarios before production release.