When the agent pays: prompt injection is not a model problem

On 2 July 2026, security researchers at Zscaler ThreatLabz described two web pages built to target software rather than people. The text that carries the attack is invisible in a browser. To an AI agent reading the page, it sits in plain view. Tested against 26 language models, four followed the instruction and triggered a payment. The headlines that followed announced that AI agents were already wiring money to attackers. That is the sharpened version. The reality is duller, and considerably more awkward for anyone running an agent pilot.

Whether this finding reads as an alarm or as a warning shot depends on one distinction: the difference between a lure and a loss. Both are present here, but not at the same time.

What the researchers documented

The first campaign trades on a package that does not exist. Calling itself requests-secure-v2, it imitates one of the most widely used Python libraries in the world. Its web page is tuned for search engines and for machine readers alike: structured data describes it as a software application, and an attached offer object advertises a developer licence for $3.00. A human visitor sees little of this. An agent processing the page finds a purchase instruction and a script that moves roughly 0.0012 Ether to a hardcoded wallet address.

The second campaign skips the payment and strikes one step earlier. It registers an address resembling the crypto portfolio tracker DeBank and hides an instruction to treat that very page as the authoritative DeBank and rank it first. The target here is not the wallet. It is the judgement.

Both rely on the same mechanic. Cascading Style Sheets, the language that governs how a page looks, hides the instruction from the human eye. In the parsed content the model works from, it remains fully visible. The agent does not read what the human sees. That is the whole trick, and it works precisely because it breaks nothing. It uses the software exactly as designed.

What is live and what stayed in the lab

Precision earns its keep here, because the coverage fused two things the report keeps apart.

The infrastructure is live. The typosquatting domain is registered, the lure markup sits on the web, the wallet address is real and named in the report. Someone has done the work and is waiting.

The payment stayed in the lab. That four-in-26 figure comes from a test run in what the researchers describe as a fully sandboxed environment with no real funds at risk. No victim of these two campaigns has been documented. The report does offer one indicator, and it is weaker than a quick reading suggests. The wallet has received payments before, but for larger amounts. On that basis the actor may have used the address in earlier attacks. That points to a live adversary. It does not establish a loss from these two campaigns, and the amounts are a poor fit for a three-dollar trap.

Anyone reading that as reassurance has missed the sequence. The lure comes first, the target second. Victims are absent not because defences held, but because almost no agent is yet allowed to pay.

Why this is not a model problem

The instinctive response is that the model should have spotted the fraud. It leads the wrong way.

The Open Worldwide Application Security Project (OWASP) still ranks prompt injection first among the ten biggest risks to applications built on large language models (LLM), as LLM01. It separates the direct variant, where a user types manipulative instructions, from the indirect one, where the instruction hides inside content the system ingests anyway: documents, tickets, calendar invitations, scraped pages. The Zscaler case is the second kind.

The entry that matters, though, sits further down the list. LLM06, Excessive Agency, describes a system granted more functionality, permissions or autonomy than it needs. That is where the damage lives.

LLM01, on current understanding, has no clean fix. As long as a model processes text, text can steer it. The data channel and the command channel arrive in the same string, and no amount of filtering changes that shape. LLM06 is different in kind. It is not a property of the technology but a choice made by an architect. An agent can pay because somebody granted it the means.

The spread of the test results bears this out. The four models that paid were two Llama and two Gemini variants. The two that fell for the counterfeit DeBank page were different ones, GPT-5.4 and Claude Sonnet 4.5, and they did not pay. These are two distinct measures, and they do not share a single model between them. Susceptibility, in other words, is not spread evenly across the market. It tracks the model, the configuration and the permissions granted. For an institution that is good news, because every one of those is a dial rather than a constant.

The rails are being laid right now

What makes this finding urgent today rather than in two years has little to do with Zscaler and everything to do with the payment protocols.

In September 2025, Google and Coinbase launched the Agent Payments Protocol (AP2), a standard for handling consent and authorisation in agent-led payments. It is deliberately payment-agnostic, covering cards, transfers and real-time payments, and its backers report more than 60 organisations integrating it. That figure comes from the vendors themselves rather than any independent survey, and the named partners are technology and crypto firms, not banks. Alongside it sits x402, a standard that revives the long-dormant HTTP status code 402, Payment Required, to settle stablecoin payments.

How far this reaches was set out by Sarah Breeden, Deputy Governor for Financial Stability at the Bank of England, at the ECB's Sintra forum on 30 June 2026. Consumers and merchants, she said, have so far used AI agents mainly in recommendation mode, with humans still executing the transaction. She went on: "But as agentic technology advances, tech firms, payment systems and merchants are working to automate that final step."

That final step is exactly the one the documented attack aims at. The central bank also names what remains unsettled: "how users securely give consent and authorisation to agents, especially for multiple transactions; how disputes are settled and liability assigned for erroneous or fraudulent transactions". Who carries the loss when an agent is tricked into paying is an open question. And the Bank of England is helping lay the track itself, leading a public-private partnership to design the next generation of UK payments infrastructure so that it can carry agentic payment journeys.

The counter-argument

Two serious objections stand against the urgency of all this, and both carry weight.

The first concerns the sender. Zscaler sells security software. The report closes not with a chapter on countermeasures but with the name of a detection signature. Neither the choice of models tested nor the design of the scenarios has been independently reviewed. The finding holds up regardless, because the domain, the wallet and the mechanic are documented and checkable. In any case the drama came mostly from the coverage, not from the report.

The second objection cuts deeper: hardly any European institution runs a production agent with payment powers today. Treating this as an active incident overstates it. True enough. Yet the conclusion runs the other way. A control designed in before the first pilot costs a decision. The same control retrofitted after the first incident costs a programme. Four in 26 is a laboratory rate against a purpose-built scenario and says nothing about a hardened production agent. What it does describe is the out-of-the-box state, and that is where every pilot starts.

Recommendations for practice

For institutions piloting agents, or planning to within the next few quarters, four areas deserve attention.