We spent last week writing about AI agents as attackers. This is the mirror image: AI agents as the victims, with the money walking out the door on its own.

Zscaler's ThreatLabz researchers uncovered two live campaigns that hide indirect prompt injections inside malicious websites and wait for an autonomous AI agent to browse in, as reported by SecurityWeek. In the first, a fake Python library called requests-secure-v2 is pushed up the search rankings through SEO poisoning; when an agent looking for it visits the page, hidden text instructs it to pay $3 for what it is told is a developer API key. In the second, a typosquatted domain, debank.auction, uses SEO-optimized structured data to convince agents it is the real DeFi platform DeBank, steering them and their users toward a fraudulent site. Neither attack involves malware. It is just a webpage and an agent that can pay.

This is the uncomfortable shape of agentic AI security. The entire value of an agent is that it acts on what it reads, which is precisely the property an attacker abuses. Give an agent the ability to move money and the freedom to browse untrusted pages, and you have wired a stranger's text directly to your wallet. Guardrails that filter the obvious "ignore your instructions" phrasing miss the quiet, plausible versions, and the blast radius is no longer a bad answer, it is a transaction.

If you are deploying agents that can pay, transact, or move assets, treat every page they read as hostile input, require human confirmation for anything irreversible, and scope the agent's permissions as tightly as you would a junior employee you had never met. The broader lesson is that prompt injection has graduated from a curiosity into a financial-fraud vector, and it needs to be tested for rather than assumed away.

Sources: SecurityWeek, with research from Zscaler ThreatLabz.