MCP Web-Fetch Context Poisoning via Embedded Agent Instructions
When an AI agent fetches or scrapes a web page, it reads everything on that page — including hidden text meant only for the AI, not for humans. Attackers plant hidden instructions in web content that tell the agent to ignore its original task, hand over credentials, or send data somewhere else.
How the attack works
An attacker plants text on a web page that a target's AI agent is likely to fetch — hidden in an HTML comment, an invisible div, an 'ai-instruction' meta tag, or a bracket-delimited block, or sometimes just in plain visible text. That text is written to look like a system or developer command, using phrases like 'ignore previous instructions' or 'override'. When the agent's fetch or scrape tool pulls in the page, the LLM reads the hidden text as part of its context and follows it as if it were a legitimate instruction. The rule flags this specifically when the hidden instruction is paired with an action like exfiltrating data or accessing credentials, since that combination indicates the injection is trying to achieve something beyond just changing tone or output style.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- dc4d0151-7bc5-486a-bb5e-e295224bea6b
- Severity
- Critical
Why it matters
An attacker can redirect an agent to leak secrets, credentials, or internal data to an attacker-controlled destination, or make the agent perform unauthorized actions, without ever touching the agent's own systems directly — just by controlling content the agent chooses to fetch.
What you can do
- →Treat all fetched web content as untrusted data, never as instructions, and enforce this separation in agent prompt design.
- →Restrict which domains or URLs an agent's fetch/scrape tools are allowed to reach, especially for agents with access to credentials or sensitive data.
- →Strip or flag HTML comments, hidden elements, and meta tags before passing fetched content into an LLM context.
- →Review agent logs for fetch actions followed immediately by data exfiltration or credential-access attempts, and investigate any that don't match the user's original request.
Known benign look-alikes
- Normal HTML comments about page layout, CSS, or developer notes
- Legitimate meta description, viewport, or charset tags
- Hidden HTML elements for loading states or accessibility
- Educational content about AI and web agents
- Security research documentation describing these patterns