Enterprise agents browsing the public web can encounter instructions designed to hijack them. Google researchers scanning Common Crawl have found hidden commands embedded in web pages, ready to influence an AI system that retrieves the content.
This indirect prompt injection differs from a user openly telling a chatbot to ignore its rules. The malicious instruction enters through a data source the agent was asked to trust, disguised in white text, metadata or other HTML invisible to a human reader.
The attack becomes dangerous when the browsing agent also holds credentials for email, databases or internal applications. Its harmful actions can look completely legitimate to conventional security tools.
Poisoned content turns authorised access against itself
Consider an HR agent asked to review a candidate’s portfolio. Hidden content could instruct it to copy an employee directory to an external destination and then produce a positive assessment.
The model receives legitimate page text and malicious commands in one stream. Without a reliable distinction between data and instruction, it may treat the embedded request as part of its task.
Firewalls and endpoint protection look for malware, unusual logins or unauthorised traffic. The agent uses an approved identity with permission to read records and send email, so every individual action may appear normal.
Observability products often track token use, latency and uptime without assessing decision integrity. An agent can drift from its purpose while dashboards show a healthy service.
Isolation and least privilege limit the damage
One defensive architecture uses a small, isolated sanitiser model to fetch external pages. It can remove hidden formatting, identify suspicious instructions and pass a plain-text summary to the more capable agent.
The sanitiser should hold no sensitive permissions. If it is compromised, it cannot access internal systems or execute consequential tools. Separation reduces the chance that untrusted content and powerful authority exist in the same process.
Zero-trust principles must also apply to the main agent. A system researching competitors needs web access, but it should not automatically write to a CRM or send external messages. Tool permissions should be granted for each workflow and revoked when the task ends.
No sanitiser is perfect. Visible text can still contain manipulative instructions, and summaries may preserve harmful meaning. High-impact actions therefore need additional validation or human approval independent of the browsing model.
Decision lineage becomes a security control
Audit trails must capture which URLs, passages and tool calls influenced an action. If a financial agent recommends a sudden trade, investigators need to trace the recommendation to exact external inputs rather than only seeing its final explanation.
That provenance supports real-time policy as well as forensics. A control layer can prevent an agent from acting when its reasoning depends on an untrusted source, or require review when retrieved content attempts to issue instructions.
Developers should test agents against poisoned pages before deployment. Evaluations need to include hidden HTML, manipulated documents and multi-step attacks that appear harmless until several sources are combined.
The internet is an adversarial environment built for human readers and software parsers, not autonomous systems deciding what to believe. Agents expand the consequences of web poisoning because they can move directly from reading to action.
Google’s warning is a reminder that model guardrails alone cannot solve the problem. Security comes from separating untrusted retrieval, restricting authority and preserving evidence across the full decision path.
An enterprise agent should never be trusted merely because it uses approved credentials and follows a valid workflow. Teams must also know precisely which external content shaped its intent. Until that distinction is enforceable, browsing agents need deliberately narrow permissions and scepticism designed into their architecture.
