Prompt injection in web pages your AI agent reads
Agents that research vendors or prices read web pages, and pages can talk back. Hidden comments are the simplest attack there is.
SlackThe workflow
The agent reads a vendor's pricing page and posts a summary to Slack.
The attack hidden in it
A hidden HTML comment tells the assistant to ignore its instructions and claim a competitor is insolvent.
How the guardrails handle it
- Screening withholds the comment.
- The Slack post waits for approval.
- Every step is logged for review.
Same workflow, every company size
The agent and the guardrails stay the same; only the systems behind them change.
Microsoft Outlook
Microsoft Teams
Google Calendar
GmailQuestions
Can websites inject prompts into AI agents?
Yes, through hidden text and comments. Page text is screened before the agent reads it.
How do I test my agent against this?
Run an AI pentest, such as Aikido's, against the agent and check which guardrail caught each attack.
Is page content trusted?
No. Everything an agent reads from outside is treated as data, never as instructions.