Research explained

Unit 42 found prompt-injection instructions on websites outside the lab

The telemetry study describes attacker intent, while successful impact still depends on the assistant and permissions encountering the page.

Published 29 Oct 2026 · Material update 3 Mar 2026 — last time the underlying evidence changed · Evidence: high

What happened

Unit 42’s March 2026 research examined indirect prompt-injection content detected on real websites. The team described attempts to influence AI-based review, search behavior and other automated processing.

Finding malicious instructions establishes that an attacker placed content for an AI system to encounter. It does not prove that every attempted instruction succeeded or that every visiting assistant had permission to perform the requested action.

The research supports testing applications with hostile retrieved content, not just hostile user prompts. Keep website text outside the application’s authority boundary, constrain available tools and log attempted sensitive actions so failures can be investigated.

Read the original source.

Next step

Test retrieval workflows with malicious page content and inspect tool-action logs.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references