Prompt Injection in 2026: What's Actually Rising in AI Search

Three independent security research teams spent 2026 scanning the live web for indirect prompt injection aimed at AI agents and AI-assisted search. Here's what they actually found, and where the evidence stops.

What actually happened in 2026

For most of the last two years, indirect prompt injection (IPI) was mainly a research topic: security researchers showed it was possible to hide instructions inside a webpage, a document, or an email, and get an AI system to follow them instead of doing what the user asked. Whether anyone was doing this outside a lab was mostly a guess.

In 2026, that changed from a guess to a measured trend — though not the dramatic one some headlines suggest. Google's Threat Intelligence Group and Google DeepMind ran a systematic sweep of the public web looking for known IPI patterns, and published their findings in April.^[1] Palo Alto Networks' Unit 42 published its own large-scale telemetry analysis in March, including the first documented case of IPI used to try to slip a scam ad past an AI-based review system.^[2] Zscaler's ThreatLabz team followed in July with two specific live campaigns that combined old-fashioned SEO manipulation with hidden AI instructions.^[3] Together, these three reports are the closest thing the industry has to real data on what's happening, rather than what's theoretically possible.

What indirect prompt injection actually is

Direct prompt injection is what happens when someone types a jailbreak straight into a chatbot. Indirect prompt injection is different and, for AI-powered search and browsing agents, more relevant: the malicious instructions live inside content the AI reads as part of doing its job — a webpage, a product listing, a piece of documentation. According to Google, the underlying mechanism is that the AI system processes this content and may silently follow the attacker's commands instead of the user's original intent^[1], because the model has no reliable way to separate "this is data I'm summarizing" from "this is an instruction I should follow."

That distinction matters for search specifically. AI-powered search doesn't just return links anymore — it reads pages, ranks them, and sometimes summarizes or acts on them. Every one of those steps is a point where hidden text can be interpreted as a command rather than as content.

The Google numbers: growth, but from a low base

Google's team scanned Common Crawl, a repository that captures 2 to 3 billion pages a month across static websites — blogs, forums, comment sections — though it notably misses most social media because of login walls and anti-crawl rules.^[1] After filtering out a large volume of false positives (mostly security blog posts and research papers that mention prompt injection without containing an actual attack), the team found genuine injection attempts falling into a handful of buckets: harmless pranks, well-meaning attempts to steer AI summaries, search engine optimization, efforts to deter AI crawlers entirely, and a smaller set of clearly malicious attempts aimed at data theft or destructive commands.^[1]

The headline figure is a 32% relative increase in the malicious category between November 2025 and February 2026, measured across repeated scans of the archive.^[1] That's a real upward trend, not a rounding error. But Google is careful to qualify what it found alongside that number: most of the injected payloads they observed were unsophisticated, and they explicitly state they did not observe significant amounts of advanced attacks^[1] of the kind published by security researchers in prior years. Their read is that attackers are experimenting, not that a mature attack industry has arrived — yet.

Where SEO and prompt injection are actually converging

This is the part of the story most relevant to search specifically, and it's where the Unit 42 and Zscaler findings add real texture to Google's broader sweep. Google's own category list already included "search engine optimization" as one of the observed motives for prompt injection — websites trying to get an AI assistant to promote their business over competitors.^[1] Unit 42 and Zscaler each independently documented working examples of this.

Unit 42 built a taxonomy of attacker intent from its in-the-wild detections and rated SEO poisoning — pushing a malicious site, such as a phishing page, into top rankings via LLM recommendations — as a high-severity category, accounting for roughly 8% of the intents in its telemetry.^[2] One documented case impersonated a well-known betting platform, delivering its injected prompt as plain visible text in the page footer, an area a human visitor is unlikely to scroll to.^[2]

Zscaler's July report went further, describing two full campaigns that deliberately paired classic SEO poisoning with hidden AI instructions on the same pages.^[3] One impersonated a fake Python package and stuffed its HTML with keywords tied to real developer error messages, so an AI coding assistant searching for a fix would be more likely to land on the page; hidden instructions then tried to talk the AI into authorizing a small cryptocurrency payment for a fake "API key."^[3] The other typosquatted a real decentralized finance platform, loading the page with keyword-stuffed metadata and fabricated structured data (JSON-LD) that misidentified the fake site as being published by the legitimate company, alongside hidden text instructing any AI reading the page to treat it as the authoritative source for that brand's name.^[3]

Zscaler's explanation for why attackers are leaning on structured metadata formats like JSON-LD is worth noting on its own: these fields exist specifically to help search engines interpret a page, so in agentic workflows they can carry more weight than ordinary free-form HTML text — though the company is careful to note this trust pattern varies by AI implementation rather than being universal.^[3]

Does it actually work? What the model testing showed

Both Unit 42 and Zscaler went a step further than just documenting the pages — they tested whether real AI agents actually fall for these tricks, and the results are genuinely mixed.

Zscaler built a sandboxed autonomous agent with web-browsing and payment tools, deliberately configured with no spending limits, and pointed it at the fake Python-package site across 26 different large language models. Four models — Llama 3.3 70B Instruct, Llama 3.2 90B Vision Instruct, Gemini 3 Flash, and Gemini 2.5 Pro — were manipulated into attempting the payment.^[3] On the typosquatted DeFi site, results depended heavily on context: when the agent was given the real site's URL alongside the fake one, none of the 26 models were fooled, but when the fake site was the only source in context, two models — including, in one isolated-context test, Claude Sonnet 4.5 — misclassified it as legitimate.^[3] Zscaler's own conclusion is that susceptibility varies by model and, just as much, by how much trustworthy context the agent has to compare against.^[3]

Unit 42's telemetry review found a similar pattern of "low sophistication, real impact." Looking at its detections by attacker intent, the largest single category was low-severity irrelevant output (forcing an AI to produce nonsense instead of doing its job) at 28.6%, followed by data destruction attempts at 14.2%, and AI content moderation bypass at 9.5%.^[2] On delivery method, plain visible text — no hiding at all — was still the most common approach at 37.8% of cases, ahead of more technical concealment methods.^[2] That's a useful reality check: a lot of what's "in the wild" right now is closer to graffiti than to a sophisticated intrusion.

Where OWASP fits in — and why the ranking looks odd at first glance

Zooming out from individual incidents, the OWASP GenAI Security Project's 2026 Top 10 for LLM Applications, released in early August, kept prompt injection at the number-one spot for the third consecutive year.^[4] That's notable because, for the first time, OWASP built this edition on a hybrid model: roughly 75% practitioner consensus and 25% weighting from a body of real-world incident data — 6,639 classifiable incidents pulled from public vulnerability databases and an AI-harm repository.^[4][5] The project's own community had grown past 30,000 members by the time the ranking was formally unveiled in September, and the guidance downloaded more than 10,000 times in its first 48 hours.^[5]

Here's the part worth pausing on: raw incident counts for prompt injection are actually comparatively low next to some other risk categories. The practitioner vote is what keeps it at the top. That's not a contradiction — mature security teams already spend heavily defending against prompt injection precisely because it's well understood, and that defensive spending is part of why fewer clean exploits show up in public databases in the first place. A low visible incident count reflects effort spent containing the risk, not proof that the risk itself is shrinking.

What's actually confirmed versus what remains uncertain

Reading these three research efforts together, a few things are solid: attackers are experimenting with hiding instructions in web content aimed at AI systems, that activity increased over the winter of 2025 into 2026, and researchers have now demonstrated — in controlled tests, not live incidents against real users — that current models can be manipulated into unwanted actions including payments and misclassifying phishing sites as legitimate.^[1][2][3] SEO poisoning specifically, aimed at getting AI search and coding assistants to surface a malicious page, is a documented and repeated pattern across two independent vendors.^[2][3]

What isn't established: none of these reports claim a large-scale, ongoing campaign successfully draining real victims' funds through an AI agent in production. Zscaler's payment tests ran in a sandbox with no real money at risk and deliberately removed spending limits to find the maximum exposure — that's a stress test of what's possible, not evidence of confirmed financial losses in the field.^[3] Google's own read of its telemetry is that most of what it found is low-sophistication experimentation rather than a mature attack industry, at least so far.^[1] Readers should treat "IPI is rising" and "IPI is currently draining accounts at scale" as two very different claims — the evidence in 2026 supports the first, not yet the second.

What this means for defenders

The defensive advice coming out of all three reports converges on a similar set of ideas, even though none of them offers a single fix. Google points to layered defenses it's built into its own products, alongside its bug bounty program for AI systems.^[1] Unit 42 highlights spotlighting — separating untrusted retrieved text from trusted instructions at the architecture level — plus instruction hierarchy and adversarial training as partial mitigations, alongside design-level defenses as a defense-in-depth layer.^[2] None of these approaches is described as a complete solution by the researchers who study them.

For anyone running an AI agent that browses, searches, or has payment or file-system access, the practical takeaway from this year's research is fairly concrete: don't give an agent standing permission to spend money or delete data without a checkpoint, be skeptical of any page that tells the AI reading it to treat that page as the "authoritative source," and remember that structured metadata like JSON-LD is not inherently more trustworthy just because it's machine-readable.

Quick comparison of the three 2026 telemetry reports

The takeaway

Prompt injection aimed at AI search and browsing agents went from a theoretical worry to a measured, growing trend in 2026 — that part is well supported. What's still missing from the public record is evidence of that trend translating into large-scale, confirmed harm to real users. SEO poisoning combined with hidden AI instructions is a real, repeated technique, not a hypothetical one, and it's worth watching closely precisely because search is one of the places where an AI system's judgment about what's "authoritative" has the most leverage over what a person eventually sees or does. Whether it stays a nuisance-level problem or matures into something more damaging is, by the researchers' own accounting, still an open question heading into next year.

Sources & References

1. Google — "AI threats in the wild: The current state of prompt injections on the web" — Google Security Blog, April 23, 2026.
2. Palo Alto Networks Unit 42 — "Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild" — March 3, 2026.
3. Zscaler ThreatLabz — "Indirect Prompt Injection in Web Content Targets AI Agents" — July 2, 2026.
4. OWASP GenAI Security Project — Top 10 for LLM Applications 2026 — Released August 3–4, 2026.
5. OWASP GenAI Security Project — Official announcement of the 2026 Top 10 and methodology — September 1–2, 2026.