How the attack works
An attacker plants text on a web page that a target's AI agent is likely to fetch — hidden in an HTML comment, an invisible div, an 'ai-instruction' meta tag, or a bracket-delimited block, or sometimes just in plain visible text. That text is written to look like a system or developer command, using phrases like 'ignore previous instructions' or 'override'. When the agent's fetch or scrape tool pulls in the page, the LLM reads the hidden text as part of its context and follows it as if it were a legitimate instruction. The rule flags this specifically when the hidden instruction is paired with an action like exfiltrating data or accessing credentials, since that combination indicates the injection is trying to achieve something beyond just changing tone or output style.
Why it matters
An attacker can redirect an agent to leak secrets, credentials, or internal data to an attacker-controlled destination, or make the agent perform unauthorized actions, without ever touching the agent's own systems directly — just by controlling content the agent chooses to fetch.
What you can do
- Treat all fetched web content as untrusted data, never as instructions, and enforce this separation in agent prompt design.
- Restrict which domains or URLs an agent's fetch/scrape tools are allowed to reach, especially for agents with access to credentials or sensitive data.
- Strip or flag HTML comments, hidden elements, and meta tags before passing fetched content into an LLM context.
- Review agent logs for fetch actions followed immediately by data exfiltration or credential-access attempts, and investigate any that don't match the user's original request.
Known benign look-alikes
- Normal HTML comments about page layout, CSS, or developer notes
- Legitimate meta description, viewport, or charset tags
- Hidden HTML elements for loading states or accessibility
- Educational content about AI and web agents
- Security research documentation describing these patterns