CounterholdLearn more

Incident · 2026 · Research experiment: autonomous web agents

Poisoned web pages get four of 26 AI models to pay a crypto wallet

In July 2026, Zscaler ThreatLabz reported web pages found in the wild that hide instructions telling AI agents to pay. In a sandbox with no real funds and no spending limit, four of 26 models tested completed the payment: Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash and Gemini 2.5 Pro.

Last updated

What happened

The first campaign used SEO poisoning to push fake documentation for a nonexistent Python package, requests-secure-v2. Hidden instructions told visiting agents that a $3 developer license was needed to fix an error, and the page carried code to send about 0.0012 ETH to a hardcoded wallet.

ThreatLabz built a web-browsing agent with payment tools, ran it in a sandbox with no real money and no spending limit, and tested 26 models. Four executed the payment.

A second campaign used a lookalike DeBank domain. With payment tools removed, GPT-5.4 and Claude Sonnet 4.5 each rated the fake site legitimate in one test condition.

What happened next

No real funds were at risk in the test. Zscaler said the attacker’s wallet had received other, larger payments, without establishing who sent them.

What would have stopped it

  1. Give agents a hard per-payment and per-day spending cap enforced outside the model.
  2. Allow payments only to an allowlist of payees, so an instruction found on a web page cannot add a new recipient.
  3. Treat any payment request that originates in fetched content as untrusted and require user confirmation.

Sources

  1. Zscaler ThreatLabz: Indirect prompt injection in web content targets AI agents
  2. SecurityWeek: Prompt injection attacks trick AI agents into making crypto payments

This page summarizes the cited sources as of October 21, 2026. It adds no findings of our own about any person or company. See an error? Email contact@counterhold.com with the subject “Correction”. Corrections are noted on this page with their date. See our terms for how we handle correction and removal requests.

Similar incidents