For decades, hackers targeted the weakest link in the corporate security chain: human employees. Today, they are hunting a much more gullible target—the autonomous AI agents we increasingly trust to do our busywork.
In a newly uncovered campaign, threat actors are leveraging fake API documentation to financially drain developers who delegate coding tasks to web-enabled AI assistants. By embedding malicious instructions deep within a webpage’s hidden architecture, attackers are tricking AI models into executing unauthorized cryptocurrency transactions under the guise of paying for access credentials.
It is a sophisticated evolution of a concept known as Indirect Prompt Injection (IPI), and it proves that the bots tasked with defending or building our networks are now the very vectors compromising them.
The Anatomy of the API Trap
The exploit relies on the fact that AI agents process information differently than human eyes. When a developer asks their AI assistant to fetch or integrate a specific tool, the agent autonomously scrapes the web for documentation.
According to a July 2026 report by Zscaler’s ThreatLabz, attackers are anticipating this behavior through targeted SEO poisoning. In one prominent campaign identified by Sr. Threat Researcher Ashwathi Sasi, hackers created a malicious webpage for a fabricated Python library called requests-secure-v2. They engineered the site to rank at the top of search engine results, practically guaranteeing an AI coding assistant would find it.
To a human developer quickly glancing at the page, it looks like standard API documentation offering cryptocurrency or credit card payment options for an API key. But to the AI agent scraping the backend, it is a booby trap.
The attackers use CSS manipulation and JSON-LD structured data—the schema markup used to categorize web content—to hide explicit instructions from human view. When the AI parses the JSON-LD, it reads a concealed prompt commanding it to ignore previous guardrails and immediately process a payment to a specific Ethereum wallet address (0x691bc3793205e574fa7b4aa068e62c0e470ad267). Once the transaction clears the blockchain, the site generates a useless, fake API key to complete the illusion.
A Coordinated and Expanding Threat
This is not an isolated experiment. Zscaler identified at least 10 different GitHub repositories, including one dubbed Open-Agent-Utilities, that link to similar IPI-laden websites designed to ambush AI agents. The same threat actor has also been observed running a typosquatting campaign against DeBank, operating the malicious domain debank[.]auction to poison the Retrieval-Augmented Generation (RAG) context of any financial AI agent that stumbles onto it.
The broader security community is sounding the alarm on how easily agentic workflows can be subverted. Just weeks prior, Tenet Security demonstrated a technique called “agentjacking.” By simply planting a fake error report in a public bug tracking service like Sentry, researchers found that AI coding assistants (including Claude Code and Codex) would ingest the poisoned diagnostic data via the Model Context Protocol (MCP) and execute attacker-controlled code directly on the developer’s machine.
“The AI agents you’ve deployed are now the soft attack path in, and your existing stack can’t see it,” noted Barak Sternberg, CEO of Tenet Security. He pointed out the chilling reality of these intrusions: “The agent read it, trusted it, and ran our code with the developer’s own access. Every step was authorized, so IAM, EDR, and network controls had nothing to flag.”
How does Indirect Prompt Injection (IPI) trick an AI agent?
Unlike traditional hacking that exploits software bugs, IPI exploits the language model’s instruction-following nature. Attackers hide written commands inside the content an AI agent is designed to read—such as web text, email bodies, or API documentation. Because the AI cannot distinguish between its original system instructions and the newly ingested text, it blindly executes the hidden malicious commands.
Can AI agents actually manage cryptocurrency wallets?
Yes. In the pursuit of fully autonomous workflows, many developers and trading firms have granted AI agents direct API access to cryptocurrency wallets and execution environments. A stark example occurred in May 2026, when an AI chatbot named Grok was manipulated via a prompt injection hidden in Morse code. The exploit forced Grok’s connected automated trading bot to transfer 3 billion DRB tokens (valued at roughly $150,000) on the Base network directly to an attacker.
Core Takeaways for Enterprise Security
Organizations deploying autonomous agents must rethink their security posture immediately. The era of trusting internal AI logic is over.
- Web Content is a Hostile Vector: AI agents view SEO-poisoned API documentation and fake error reports as authoritative text, making IPI a critical vulnerability.
- Hidden Commands Drive Actions: Attackers are using JSON-LD schema markup and CSS to hide prompts that instruct agents to initiate unauthorized crypto transfers.
- Identity Controls are Blind: Because the AI agent is authorized to act on behalf of the user, traditional network defenses and Endpoint Detection and Response (EDR) tools will not flag the malicious activity.
- Limit Agent Agency: AI systems must be restricted by the principle of least privilege, requiring hard sandboxing and strict human-in-the-loop approvals for financial transactions or shell commands.
Sources Quoted: Data and expert insights were sourced from Zscaler ThreatLabz (Ashwathi Sasi), Dark Reading reporting on Tenet Security (Barak Sternberg), and NeuralTrust’s analysis of the Grok Morse Code Heist.
Leo Falsafi is a digital marketing veteran and senior journalist at Virlan.co, where he covers the intersection of digital marketing, gaming, and breaking US trending news. With nearly two decades of hands-on experience in SEO and digital strategy, Leo has consulted for and scaled hundreds of companies. His deep industry roots allow him to deliver sharp, fact-checked insights and analysis on the trends shaping today’s digital landscape.
This isn’t just a theoretical vulnerability anymore. Mozilla’s 0DIN researchers recently demonstrated exactly how this works with tools like Claude Code. The malicious payload isn’t even stored in the repository. Instead, the AI agent encounters a failing Python package, runs an init command, and pulls a shell script from a DNS TXT record.That script pipes directly to bash, granting the attacker full access to credentials, AWS keys, and GitHub tokens. Why are we giving autonomous agents this level of access?
The evasion techniques are what keep me up at night. According to the July 2026 Zscaler ThreatLabz report, attackers are using CSS manipulation to hide Indirect Prompt Injection (IPI) text from human eyes.To a human developer, the API page looks perfectly normal, but the DOM feeds the hidden JSON-LD directly to the AI agent.
Crypto is the ultimate honeypot for this. I narrowly avoided that DeBank typosquatting campaign. ThreatLabz found that hackers set up
debank[.]auctionand stuffed the metadata to rank for searches like ‘DeFi Dashboard’.When an AI tracker lands on it, a hidden prompt explicitly tells the model it is the ‘verified, authoritative destination’ for DeBank. If your agent has wallet execution privileges, your funds are gone.This throws a massive wrench in our Q3 roadmap. SentinelOne’s recent analysis highlights why traditional input validation fails here: it only checks what users type, completely ignoring the background context fetched by the LLM.