Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments
AI agents that browse the web and can pay
SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients.
Why this severity: Still active, a warning with little reported loss.
AI involvement
AI agents as the target. The pages carry hidden instructions written for AI agents, telling them to make crypto payments or to trust a fake DeBank site.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- Jul 6, 2026
- Closed
- Jul 6, 2026
- Chains
- Multiple EVM chains
- Method
- AI agent hijacking
At risk
- AI agents that browse the web and can pay
- Multiple EVM chains wallets
What to do now
- Review your agent's recent payments and the sites it visited, and pause automatic payments until limits are set.
- Make sure the agent cannot install packages or pay recipients it found on the open web without your approval.
Stay safe
Am I affected?
You are at risk if you run an AI agent that browses the web and can make payments or sign transactions, especially one that looks up packages or DeFi tools on its own.
What to do now
- Review your agent's recent payments and the sites it visited, and pause automatic payments until limits are set.
- Make sure the agent cannot install packages or pay recipients it found on the open web without your approval.
How to avoid this
- Give the agent a small, capped wallet and an allow-list of payment recipients.
- Keep agents that sign transactions away from untrusted web content, or split browsing and signing with human approval in between.
- Bookmark official DeFi sites such as DeBank instead of letting an agent find them through search.
Timeline 1
SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.
Source
News & write-ups ›1
How this method works
An AI agent that can move funds reads hidden instructions, in a post, web page, document, token name or its own memory, and sends the funds to the attacker. Read about ai agent hijacking →
Follow new drains and updates in your feed reader or Telegram RSS bot.