Google Documents 32% Rise in Prompt Injection Attacks on Web Pages Targeting AI Agents — PayPal Exploit Payloads Found
If you’re deploying AI agents that browse the web, read documents, or process external content — Google’s latest threat research should be on your radar. The company’s Threat Intelligence team scanned 2-3 billion web pages monthly between November 2025 and February 2026, and found a 32% rise in malicious indirect prompt injection (IPI) payloads hidden in public web content. These aren’t theoretical attacks. The research documented live payloads including instructions to trigger PayPal transactions, delete files, and exfiltrate credentials — all embedded in ordinary-looking blog posts, forum threads, and web pages that AI agents might legitimately read. ...