{"id":197,"date":"2026-10-29T07:19:23","date_gmt":"2026-10-29T07:19:23","guid":{"rendered":"https:\/\/bugskan.com\/?p=197"},"modified":"2026-10-29T07:19:24","modified_gmt":"2026-10-29T07:19:24","slug":"unit-42-found-prompt-injection-instructions-on-websites-outside-the-lab","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/unit-42-found-prompt-injection-instructions-on-websites-outside-the-lab\/","title":{"rendered":"Unit 42 found prompt-injection instructions on websites outside the lab"},"content":{"rendered":"<p>Unit 42\u2019s March 2026 research examined indirect prompt-injection content detected on real websites. The team described attempts to influence AI-based review, search behavior and other automated processing.<\/p>\n<p>Finding malicious instructions establishes that an attacker placed content for an AI system to encounter. It does not prove that every attempted instruction succeeded or that every visiting assistant had permission to perform the requested action.<\/p>\n<p>The research supports testing applications with hostile retrieved content, not just hostile user prompts. Keep website text outside the application\u2019s authority boundary, constrain available tools and log attempted sensitive actions so failures can be investigated.<\/p>\n<p><a href=\"https:\/\/unit42.paloaltonetworks.com\/ai-agent-prompt-injection\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The telemetry study describes attacker intent, while successful impact still depends on the assistant and permissions encountering the page.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_a641c11e10924c","bugskan_event_type":"research","bugskan_response":"unknown","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"Unit 42\u2019s website telemetry and prompt-injection analysis.","bugskan_recommended_next_step":"Test retrieval workflows with malicious page content and inspect tool-action logs.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-03-03T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[3],"bugskan_technology":[],"class_list":["post-197","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-research-explained"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=197"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/197\/revisions"}],"predecessor-version":[{"id":378,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/197\/revisions\/378"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=197"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=197"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}