What happened
An IBM Master Inventor showed a shopping agent he had built, and an IBM Distinguished Engineer explained the attack. The agent found five matching listings, then stopped searching and bought from one seller.
The seller’s page carried hidden text that a person could not see but the agent read. The agent’s reasoning log showed correct initial parameters, yet its final action followed the hidden instruction.
What happened next
This was a demonstration, not a reported real-world loss. The write-up does not say whether the purchase was live or staged.
What would have stopped it
- Strip hidden and zero-size text from fetched pages before the agent reads them, and flag pages where visible and extracted text differ.
- Enforce the user’s budget and “cheapest acceptable listing” rule in the purchase tool, outside the model.
- Require confirmation when the chosen listing is far above the median of the listings found.
Attack families
Test scenarios
Sources
- StartupHub.ai: Hidden prompt injection and overpaying for books
- YouTube: Securing AI Agents: How to Prevent Hidden Prompt Injection Attacks
This page summarizes the cited sources as of October 21, 2026. It adds no findings of our own about any person or company. See an error? Email contact@counterhold.com with the subject “Correction”. Corrections are noted on this page with their date. See our terms for how we handle correction and removal requests.
Get in touch
Test your agent against cases like this.
Tell us about your agent and we’ll be in touch to learn what you need.