What happened

Unit 42 observed live indirect-prompt-injection attacks against AI agents that browse the web. Pages contain hidden instructions (off-screen text, comments, image alt-text) that hijack the agent's reasoning when it reads them.

Observed outcomes: agents asked to 'summarize this article' instead exfiltrate the user's environment to an attacker-controlled URL, or call tools the user didn't request.

This is no longer a research curiosity — it's a deployed TTP.