Palo Alto Unit 42 Confirms Real-World Prompt Injection Attacks on AI Agents

Palo Alto Networks' Unit 42 research team has documented confirmed, real-world indirect prompt injection attacks targeting AI agents powered by large language models. Attackers embedded hidden malicious instructions within ordinary web content that AI agents were directed to browse as part of their normal workflows. When the agents fetched and processed this content, they treated the attacker-controlled instructions as legitimate commands, in some cases executing high-severity, fraud-level actions. The core vulnerability lies in the model's inability to distinguish between trusted instructions and untrusted external content, since both appear as plain text within its context window. Security experts warn that conventional defenses such as web application firewalls and input validation do not address this threat, as the malicious content enters through tool results rather than direct user input.