Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild

In-the-wild web prompt injections attempting to force AI agents into Stripe/PayPal payments

AIR-2026-0059 AIR record · 2026-03-unit42-idpi-payment-hijack
Open in dashboard About
From the supporting source
prompt that redirects a viewer to a page from a legitimate online payment system with an account controlled by the attackersunit42.paloaltonetworks.com
The record
Disclosed
2026-03-03
Product
Web-browsing AI agents / AI shopping and summarization agents
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the browser agents followed links toward attacker payment pages
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web page
Impact type
Unauthorized transaction, Financial loss
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Any browsing agent that renders and follows instructions on the attacker pages (perceptivepumpkin.com, shiftypumpkin.com, llm7-landing.pages.dev, runners-daily-blog.com)
Capability abused
web_browsinglink_followingtransaction_initiation
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI02 Tool Misuse and Exploitationindirect_prompt_injectionin_the_wildunauthorized_transaction
Curator notes
Unit 42 case #5 (forced Stripe donation via buy.stripe[.]com link) and case #7 (attempt to send $5,000 to an attacker-controlled account). No confirmed completed transaction is reported, so impact_realized is false.
Supporting sources
Cite as
Enkrypt AI. "In-the-wild web prompt injections attempting to force AI agents into Stripe/PayPal payments". AIR, AIR-2026-0059. https://agentincident.vercel.app/i/AIR-2026-0059/ (accessed 2026-10-19).