In the wild
First real-world indirect prompt injection observed against an AI ad-review agent (reviewerpress.com)
AIR-2026-0058 AIR record · 2026-03-unit42-idpi-ad-review
From the supporting source
To our knowledge, this is the first reported detection of a real-world example of malicious IDPI designed to bypass an AI-based product ad review system.unit42.paloaltonetworks.com
The record
Disclosed
2026-03-03
Product
AI-based product ad review system (unnamed)
Risk domain
Governance › Policy drift
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the ad-review agent made the moderation decision on injected content
Attack surface
Autonomous operations
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web page
Impact type
Content moderation bypass
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
AI ad-review agents that crawl attacker-controlled ad landing pages
Capability abused
Taxonomy & references
Curator notes
From Unit 42's 'Fooling AI Agents' post (Kaleli, Farooqi, Starov, Mohamed). Detected Dec 2025; scam page at reviewerpress[.]com embedded layered injections (zero-size fonts, off-screen positioning, CSS suppression, SVG encapsulation). Not known whether the review bypass actually succeeded, so impact_realized left false. The post itself is a survey of 22 delivery techniques across 12 cases; only the specific named cases are recorded.
Supporting sources
Cite as
Enkrypt AI. "First real-world indirect prompt injection observed against an AI ad-review agent (reviewerpress.com)". AIR, AIR-2026-0058. https://agentincident.vercel.app/i/AIR-2026-0058/ (accessed 2026-10-19).