Three posts from spring 2026 on indirect prompt injection: how AI agents get manipulated by the pages they read, why single-fetch scanners miss it, and what the IMF's warning means for the public web.
When ChatGPT browses the web to summarize a news article, it doesn’t just see the rendered text a human would see. It reads the full HTML — including elements hidden via CSS, comments, alt-text, metadata, and content cloaked to AI user-agents. This post walks through six concrete attack vectors and explains what traditional scanners miss.
Read →Burp Suite, OWASP ZAP, Snyk, and every other web vulnerability scanner share an architectural assumption that breaks the moment AI agents started reading websites on behalf of users. This post explains the gap, walks through three attack classes only multi-agent fetching detects, and frames why “AI-agent web security” is a category that requires different infrastructure.
Read →On May 7, 2026 the IMF named AI-driven cyber risk as a core financial stability issue. The framing focused on AI as attacker tool. It was silent on AI agents as new attack surface. This post connects the IMF systemic-risk argument to the public web that AI agents read on behalf of users, and lists three concrete implications for marketing-site operators ahead of late-2026 supervisory expectations.
Read →These posts date from spring 2026, when EverHarden was building a scanner for prompt injection in web content. We have since moved on to reviewing what AI agents are allowed to do (see the home page). The posts still hold up, so they stay here.
If a piece is missing a citation or you spot an error, write to hallo@everharden.com. We correct mistakes and say so.