Cross-Site Prompt Injection

Unlike direct prompt injection, the attacker never interacts with the target AI agent or its user. The malicious payload is planted in a third-party resource—a webpage, PDF, or public document—that the agent is instructed to browse or retrieve.

• The user asks their agent to summarize a webpage.
• The agent fetches the page, which contains hidden adversarial text.
• The agent's behavior is hijacked without the user's knowledge.

This trusted third-party compromise makes the attack extremely difficult to attribute and block at the user interface level.

Attackers embed malicious instructions using methods invisible to human visitors but fully parseable by AI agents. Common techniques include:

• Zero-font text: Characters sized to 0px in CSS, invisible on screen but present in the DOM.
• Same-color text: White text on a white background, hidden from human eyes.
• HTML comments: Instructions placed inside <!-- comment --> tags.
• Alt text injection: Malicious prompts embedded in image alt attributes.
• Hidden divs: Content placed in elements with display: none or visibility: hidden.

These techniques exploit the gap between human visual rendering and machine text extraction.

When an agent fetches a poisoned webpage, the entire page content—including hidden text—is ingested into the context window alongside legitimate content and system instructions.

• The model cannot inherently distinguish between trusted system prompts and untrusted web content.
• Malicious instructions can override, append to, or replace the agent's original directives.
• The attack exploits the flat context architecture of transformer models, where all tokens have equal access to attention mechanisms.

This contamination is particularly dangerous in RAG-based agents that automatically retrieve and process external content.

Cross-site prompt injection often unfolds in multiple stages to evade detection and maximize impact:

• Stage 1 - Ingestion: The agent fetches the poisoned page and loads the hidden payload into context.
• Stage 2 - Instruction Override: The payload instructs the agent to ignore previous directives and adopt a new, malicious objective.
• Stage 3 - Tool Exploitation: The compromised agent is instructed to call tools, exfiltrate data, or execute API calls.
• Stage 4 - Persistence: The payload may instruct the agent to insert the attack into its memory or conversation history for future sessions.

This chained execution model makes CSPI a powerful vector for autonomous agent compromise.

CSPI fundamentally violates the trust boundary between system instructions and untrusted data. In secure system design, data from external sources should never be able to control execution flow.

• The attack succeeds because LLMs process instructions and data through the same inference mechanism.
• There is no inherent privilege separation between system-level directives and third-party content.
• Mitigation requires architectural solutions like context window segmentation and instruction hierarchy enforcement.

This represents a paradigm shift from traditional injection attacks, where code and data are processed by separate interpreters.

The impact of CSPI is dramatically amplified when the compromised agent has access to tools, APIs, and autonomous execution capabilities:

• Data exfiltration: The agent is instructed to send conversation history or retrieved documents to an attacker-controlled endpoint.
• Credential phishing: The agent prompts the user to re-authenticate, capturing credentials.
• Transaction manipulation: In financial agents, the payload can modify payment destinations or amounts.
• Lateral movement: The agent uses its API access to probe internal systems.

This blast radius amplification makes CSPI a critical threat for production agent deployments with tool-calling capabilities.