The web that marketing agents read is starting to read back. Google, scanning a repository of two to three billion crawled pages a month, recorded a 32% relative increase in pages carrying malicious hidden instructions aimed at AI systems between November 2025 and February 2026. Forcepoint’s X-Labs team, hunting separately across public web infrastructure, found live payloads triggering on phrases such as “Ignore previous instructions” and “If you are an LLM”.

Indirect prompt injection inverts the assumption most marketing teams are working from. An agent given a task does not distinguish cleanly between the instruction it was given and the text it encounters while carrying that instruction out. A competitor’s pricing page, an inbound supplier PDF, a comment thread, a shared drive full of briefs written by people outside the department: each is a channel through which someone else can address the agent directly. Meta put a number on how often that works when it shipped Muse Glimmer on 10 August, publishing an attack success rate of 28.4% for its own model on the standard benchmark.

What are attackers hiding in web pages?

Google’s April report separates the harmless from the hostile. The benign category runs to pranks and unsolicited guidance, including instructions to change an agent’s conversational tone or to add a note telling readers to check facts themselves. The malicious categories are more pointed: search engine manipulation and traffic hijacking, denial of service aimed at stopping agents retrieving content, data exfiltration targeting items such as API keys, and outright destruction, including instructions to delete files on the user’s machine.

Forcepoint documented attempts at financial fraud. One payload carried a fully specified PayPal transaction with step-by-step instructions written for agents that hold payment capability. Another combined meta tag namespace injection with a persuasion keyword to route AI-mediated payments towards a Stripe donation link. A third looked like a distributed test payload, probing which systems respond before anything higher-impact is deployed.

Concealment takes ordinary web craft. The commonest methods shrink text to a single pixel, drain its colour to near-transparency, or mark it hidden with standard styling. The more considered approach buries the payload in HTML comments or in page metadata, which is territory a marketing team already owns and rarely re-reads. Neither research team found evidence of sophisticated coordinated campaigns, though Forcepoint noted that injection templates shared across multiple domains point to organised tooling rather than isolated experiments.

How often do agents actually fall for it?

Meta’s published figure for Muse Glimmer is 28.4% on Siren AgentDojo, the benchmark that measures how often a model completes an attacker’s injected task, against 25.6% for Google’s Gemma4-31B. Those are Meta’s own numbers for Meta’s own model, and they are unusual mainly in being disclosed at all. AgentDojo itself, built by Debenedetti and colleagues in 2024, runs 97 user tasks and 629 security test cases across domains including email, banking and Slack, and scores utility alongside security so that a model cannot pass by refusing to work.

Independent benchmarks have said much the same for two years. Meta’s own CyberSecEval 2 paper reported that every model it tested, including GPT-4 and Llama 3 70B-Instruct, showed between 26% and 41% successful prompt injection, and stated plainly that conditioning the risk away remains unsolved. Agent Security Bench recorded a peak average attack success rate of 84.3%. WASP, testing web agents end to end, found partial success in up to 86% of cases and characterised much of the current safety margin as agents failing attacks through incompetence rather than resistance.

Training helps and does not finish the job. Anthropic reports roughly 1% attack success for Claude Opus 4.5 after adversarial reinforcement learning, while stating that 1% still carries meaningful risk and that “no browser agent is immune to prompt injection”. At volume that residual matters: a workflow making 250,000 model calls a month at a 4% rate is absorbing thousands of successful injections.

Do the available defences hold?

OpenAI, Anthropic and Google DeepMind answered that question themselves, and the answer was no. In October 2025 a team of fourteen researchers from those three labs and ETH Zürich published “The Attacker Moves Second”, taking twelve recent defences and attacking each one adaptively, tuning the attack to that defence’s specific design using gradient descent, reinforcement learning, random search and human-guided exploration. All twelve fell, most above 90%. The majority had originally reported near-zero attack success rates. Prompting-based defences such as spotlighting and prompt sandwiching collapsed to between 95% and 99%. Training-based approaches reached 96% to 100%. Separately, Zhan and colleagues at Illinois broke all eight indirect-injection defences they tested, consistently above 50%.

CaMeL is the partial exception, and it holds because of architecture rather than judgement. The Google DeepMind design separates a privileged model that sees only trusted user instructions and plans actions from a quarantined model that processes untrusted data and cannot call tools. Its guarantees come from that separation rather than from the model’s judgement, which is why it survives attacks that defeat prompt-level defences.

That points marketing teams towards the practical question, which is scope rather than model choice. Forcepoint’s finding is that impact scales with privilege: an agent that can only summarise a page is a low-risk proposition, while one that can send email, run commands or move money is a target worth building templates for. A research agent reading competitor sites with no ability to write anywhere is a different risk from an agent with inbox access and a corporate card. Meta’s own published guidance, its Agents Rule of Two, argues that an agent should not simultaneously handle untrusted input, hold access to private data and change state or communicate externally without a human in the loop.

Google said it repeated its scan across multiple versions of the CommonCrawl archive to confirm the increase. It has not published a figure for how many of those pages an agent following an ordinary research task would encounter.