Skip to content

Back to the catalog

AI Security Briefing
securityweek.comarticle

AI Security Briefing

SecurityWeek reports on Zscaler research uncovering two indirect prompt injection campaigns aimed at AI agents: one uses SEO-poisoned fake documentation for a Python package (requests-secure-v2) to trick agents into making cryptocurrency payments for a fake "API key," hiding instructions in schema markup and hidden HTML divs; the other typosquats the DeFi platform DeBank to get agents to trust a fraudulent site as legitimate. Zscaler built an autonomous payment-capable AI agent and tested 26 LLMs, finding four (Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, Gemini 2.5 Pro) could be manipulated into paying, while Claude Sonnet 4.5 and GPT-5.4 misidentified the fake DeBank site as legitimate.

TL;DR Zscaler found indirect prompt-injection campaigns (fake PyPI package docs, typosquatted DeBank) that trick AI agents into making crypto payments, successfully manipulating 4 of 26 tested LLMs.
Open original ↗

Organisations named here

  • DeBank

Technologies named here

  • Zscaler
  • Llama 3.3 70B Instruct
  • Llama 3.2 90B Vision Instruct
  • Gemini 3 Flash
  • Gemini 2.5 Pro
  • Claude Sonnet 4.5
  • GPT-5.4
  • Python
  • PyPI
  • Ethereum
  • LLaMa
  • Gemini
  • Claude

Techniques named here

  • Indirect prompt injection
  • SEO poisoning
  • Hidden prompt injection via schema markup
  • Hidden HTML element prompt injection
  • Typosquatting
  • Metadata spoofing for search ranking

Threat actors named here

  • Threat actor behind DeBank typosquatting campaign

Related in AI Security