A Wallet Drained by a Web Page

In early July 2026, security researchers at Zscaler’s ThreatLabz team reported something that should worry anyone deploying AI agents: two real-world campaigns where attackers hid instructions inside ordinary websites, tricking autonomous AI agents into making unauthorized cryptocurrency payments. One page disguised the request as a $3 fee for a developer API key. Another impersonated a well-known crypto platform so convincingly that AI agents mistook the fake site for the real one.

Neither campaign involved hacking in the traditional sense. No one broke into a server or cracked a password. The attackers simply wrote text a machine would read and obey — and it worked.

This incident is a useful entry point, but it’s really a symptom of something bigger. As organizations hand AI agents more autonomy; letting them browse, transact, and act on their own, they are opening a category of risk most security programs weren’t built to handle. This article looks at that broader shift: what prompt injection is, why agents are such an attractive target, why traditional defenses fall short, and what organizations need to do differently, with the Zscaler campaigns as a case study along the way.

What Is Prompt Injection?

Prompt injection is what happens when someone sneaks instructions into content an AI is going to read, hoping it treats those instructions as legitimate commands rather than data to process.

Think of it like handing someone documents to summarize, except one page has a note taped to it that says, “ignore everything else and wire me $500.” A trained human would spot that as an obvious scam. Many AI systems, right now, aren’t nearly as good at telling the difference.

There are two broad flavors. Direct prompt injection is typed straight into a chat window, trying to override the AI’s guidelines. Indirect prompt injection is quieter and scarier: the malicious instructions are buried in something the AI reads on its own, like a webpage or code documentation. The AI never talks to the attacker directly; it just stumbles onto the trap while doing its job. Attackers have even hidden instructions using CSS code that shoves text off-screen, invisible to a person but fully readable to an AI parsing the page’s structure.

Why AI Agents Are Such an Attractive Target

Prompt injection isn’t new as a concept, but it’s becoming a serious problem now for one specific reason: AI agents don’t just answer questions anymore. They act, browsing the web, filling out forms, calling other tools, and in a growing number of setups, holding wallets and moving money on a person’s behalf.

That shift from talking to doing is what makes agents worth targeting. A chatbot fooled by a hidden instruction might say something embarrassing. An agent fooled might send money or trigger a workflow with real consequences. Zscaler’s own research found AI-driven transaction volume grew by more than 83% year over year, meaning the number of moments where a hidden instruction could redirect an outcome is growing just as fast.

Attackers have also noticed agents can be easier to fool than people. A human employee might pause at an unusual request. An agent following instructions has no instinct telling it something feels off, unless that instinct has been deliberately built in.

Why Traditional Cybersecurity Defenses Fall Short

Most existing security tools were built to catch known malware signatures, suspicious network traffic, or phishing emails aimed at people. Prompt injection slips past all of that, because there’s no malicious file to scan and no obviously fraudulent link for a spam filter to catch. The “attack” is often just ordinary-looking text sitting quietly on a legitimate-seeming webpage.

Firewalls and antivirus tools were not designed to evaluate whether a sentence embedded in a webpage is secretly a command. The blockchain problem makes the stakes worse, too: if an agent is tricked into approving a wire transfer at a company, someone can usually claw the funds back. Cryptocurrency doesn’t offer that safety net. Once an agent sends funds to an attacker’s wallet, it’s gone for good.

This gap shows up clearly in testing. When Zscaler ran its discovered techniques against 26 different language models in a sandbox, four completed a fraudulent payment, and two misclassified a typosquatted crypto site as the real platform, a reminder that model-level safeguards vary widely and can’t be the only line of defense.

How Organizations Should Prepare

Security researchers are candid about one thing: there’s no fully reliable way to stop prompt injection outright. Language models are built to follow instructions, and teaching them to perfectly distinguish a legitimate command from a manipulative one is still unsolved. That doesn’t mean organizations are helpless, it means the strategy has to shift from prevention alone to containment.

°   Give every agent its own scoped identity, rather than letting it inherit broad permissions or reuse a shared login.

°   Default to least privilege, and make it temporary — access should expire the moment a task ends.

°   Put a human in the loop for anything irreversible, like payments, before execution, not after.

°   Watch how agents behave, not just what they say. Logging tool calls help catch an agent acting outside its normal pattern.

°   Treat external content as untrusted by default — any webpage an agent reads should be handled like an unsolicited attachment.

None of these controls are exotic. They are the same principles that have protected sensitive systems from human error for years — least privilege, separation of duties, oversight on anything that can’t be undone. What’s new is applying them to software that increasingly acts and spends on its own.

The Zscaler Campaigns as a Case Study

It is worth returning to where this started, because the details matter. The first campaign built a fake Python library page named “requests-secure-v2” and buried instructions telling any visiting AI agent to pay a small fee for a developer API key. The second used a typosquatted domain, debank[.]auction, built to impersonate the legitimate DeFi platform DeBank, with structured data crafted to convince AI agents it was the genuine site.

Neither attack needed to fool many models to be worthwhile. Out of 26 tested, just four completed the fraudulent payment and two misclassified the fake platform and that was enough. Researchers tracking the attacker’s wallet confirmed it had already received multiple payments from compromised agents by the time the findings went public.

What makes this case study valuable is not the dollar amount, which was small. It’s that the campaigns worked using nothing more sophisticated than hidden text and a convincing domain name, no malware or stolen credentials. That’s the uncomfortable lesson for any organization deploying agents with real-world permissions: the barrier to compromise here is remarkably low.

The Road Ahead for Agent Security

This will not be the last incident of its kind. As more organizations deploy agents with browsing and transaction abilities, the incentive for attackers to target them will only grow. Expect more typosquatted domains built to fool AI crawlers, more hidden-text tricks embedded in ordinary web content, and more attempts to poison the data agents rely on to make decisions.

The organizations best positioned for what’s coming won’t be the ones waiting for a perfect fix to prompt injection. They will be the ones that built their agent programs assuming compromise is possible, and designed permissions and monitoring so that when it happens, the damage is small and recoverable rather than catastrophic and final.

Conclusion: Key Takeaways

The wallets drained in the Zscaler-documented campaigns were mostly small amounts, but that was never the point. The researchers were not reporting a crypto scam, they were reporting proof that AI agents, operating exactly as designed, can be talked into working against the organizations that deployed them, by nothing more than a hidden line of text on a web page.

°   Zscaler documented two live campaigns in July 2026 where hidden web content tricked AI agents into making unauthorized cryptocurrency payments.

°   Prompt injection works by embedding instructions in content an AI reads, not by hacking systems directly — indirect prompt injection is especially hard to detect.

°   AI agents are attractive targets because they act, not just answer — and agentic transaction volume is growing over 80% year over year.

°   Traditional security tools like firewalls and antivirus were not built to catch hidden text-based instructions, and crypto payments can’t be reversed once sent.

°   Organizations should assume some prompt injection attempts will succeed, and focus on scoped identities, least privilege, human approval for irreversible actions, and behavioral monitoring to limit the damage.

As more companies hand agents real autonomy, the line between a helpful assistant and an exposed attack surface gets thinner. The organizations that come through this safely will be the ones that assumed, from day one, some prompt would eventually slip through and build their systems so the damage stayed small when it did.