# 10 Live Indirect Prompt Injection Payloads Found Targeting AI Agents in the Wild

> Researchers found prompt injection attacks already embedded in real websites — waiting to hijack AI agents that read them.

- Org: Forcepoint / Google
- Date: 2026-04-24
- Category: security
- Source: https://www.helpnetsecurity.com/2026/04/24/indirect-prompt-injection-in-the-wild/
- Canonical page: https://ai-tldr.dev/releases/forcepoint-indirect-prompt-injection-wild/

## In short

Forcepoint and Google published back-to-back reports finding 10 live indirect prompt injection payloads on real websites: recursive file deletion for AI coding tools, $5,000 PayPal fraud links, API key theft, and content suppression. Google found a 32% rise in malicious injections Nov 2025–Feb 2026.

## What it is

Forcepoint X-Labs and Google published independent research in April 2026 documenting indirect prompt injection attacks found in the wild — not theoretical proofs-of-concept. The attacks embed invisible instructions in web pages (hidden via pixel-shrinking, color draining, HTML comments, or metadata) that trigger when AI agents browse or summarize those pages. Forcepoint catalogued 10 distinct attack payloads across live websites; Google scanned billions of pages and found a 32% increase in malicious injections between November 2025 and February 2026.

## How it works

When an LLM-powered agent reads a web page containing hidden instructions, it treats those instructions as trusted directives. Real payloads discovered include: instructions to run `rm -rf` on AI coding tool environments with shell access; embedded PayPal links with fixed $5,000 amounts targeting payment-capable agents; commands to extract and exfiltrate API keys; and false copyright notices suppressing agent responses. Forcepoint found shared injection templates across multiple domains, suggesting organized tooling rather than isolated experiments.

## Why it matters

The threat is no longer hypothetical — these payloads exist on live websites right now. The severity scales directly with agent permissions: a browser summarization agent is low risk, but an agentic IDE with shell access or an agent that can execute payments is a high-value target. The 32% year-over-year growth in malicious injections tracked by Google signals an active and growing adversarial ecosystem targeting AI agents.

## Who it's for

Security teams and developers deploying AI agents with web access or shell execution permissions

## Links

- [Help Net Security](https://www.helpnetsecurity.com/2026/04/24/indirect-prompt-injection-in-the-wild/)
- [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/researchers-10-wild-indirect/)