Zscaler finds autonomous agents succumb to IPI traps

Security testing found that autonomous AI agents can be manipulated by hidden instructions embedded in websites, a vulnerability called indirect prompt injection traps. Some of the most advanced language models fell victim to these schemes, though susceptibility varied across different models, while lower-level models sometimes performed better. The concern is significant because as AI agents become common tools for accessing the web, the content itself becomes a larger attack surface, and the fundamental architecture of transformer-based systems cannot cleanly separate untrusted content from trusted instructions when both exist in the same context window. The risk is particularly acute for agents with authorization over high-stakes business functions like procurement or financial transactions, where the damage could be far greater than the small-scale payment scams demonstrated in testing.