Zscaler shows prompt injection can drain AI agent crypto wallets

Zscaler researchers uncovered two active campaigns using indirect prompt injection to manipulate AI agents browsing the web into making unauthorized crypto payments and trusting fraudulent DeFi platforms, the security firm said on July 6. Across 26 large language models tested with browsing and payment capabilities, four models including Gemini 3 Flash and Llama 3.3 70B Instruct executed the embedded payment instructions.

The findings, first reported in Zscaler's ThreatLabz research published by SecurityWeek on July 6, mark the first public documentation of an end-to-end attack chain that combines SEO poisoning, hidden schema markup, and schema-encoded payment instructions to drain agent-controlled wallets. The researchers' test agent is the same autonomous setup the firm has used to evaluate agent behavior on past campaigns, and the new results are the first to show real money movement against multiple production models. Zscaler framed the work as evidence that the content of a page is now a larger attack surface than the page's host or domain.

The two prompt injection campaigns in the wild

The first campaign hides the payment inside a fake Python package called requests-secure-v2. Threat actors registered the typosquat to rank for agent and developer searches for the popular requests library, then stuffed the page with keywords, hidden HTML, and Schema.org markup instructing any visiting agent to pay a small amount of cryptocurrency to acquire an API key. The hidden payment instructions live inside a div tag and a Schema.org PaymentRequest block, with the destination wallet hardcoded into the page source. The marketing layer is a fake API subscription business; the actual payload is the payment request itself.

When a human visits the site in a regular browser, the same instructions surface as a credit card or crypto payment form for what looks like an API key purchase. The page is engineered to behave one way for a person and another way for an agent, and the page's HTML is structured so that the visible content reads like a normal documentation site. The threat actor has been promoting at least 10 GitHub repositories that link back to the same family of websites, and the campaign has been running long enough to surface on the first page of search results for some installation queries. Zscaler researchers noted that the threat actor is iterating on the wording and the schema payload, suggesting an active operator rather than a one-off experiment.

The second campaign is a typosquat of DeBank, the decentralized finance portfolio tracker. The fake DeBank page is stuffed with DeBank Login, DeFi Dashboard, and Crypto Tracker keywords and uses Open Graph and Twitter Card metadata to make the link look like the official DeBank service. The embedded prompt tells visiting agents that the impersonating page is the legitimate DeBank domain. Of 26 LLMs tested, four were tricked into making a payment on the first campaign and two, Claude Sonnet 4.5 and GPT-5.4, miscategorized the fraudulent site as the trusted DeBank platform. Both failure modes are dangerous: the first drains the wallet, the second moves trust to the attacker for the rest of the session.

Why the indirect injection works on production models

The reason the attack works is that the threat actor is exploiting the way autonomous agents process schema markup and hidden HTML. A typical agent reads the page, parses the structured data, and follows the encoded instructions without checking the legitimacy of the underlying site. The Schema.org PaymentRequest block looks like a normal API call to a model that has been trained to treat structured data as instructions, and the destination wallet is treated as just another endpoint to call. The hidden div tag is invisible to a human, but is parsed by an agent that is reading the full DOM for context.

Zscaler's test agent used the same architecture as a production web-browsing agent, with payment execution wired into the response handler. The 26 models tested include most of the major commercial and open-weight LLMs in 2026, and the four that executed the payment share a common trait: they treat Schema.org markup as instructions rather than data. The two that miscategorized the fake DeBank page have weaker domain trust scoring and will accept any page that looks like a known service as the canonical version. The combined failure surface is the same: the agent trusts the page's structured data more than the page's origin, and the attacker has control over the structured data.

The fix is not a single patch. Schema.org and other structured data formats were designed for human-readable content, not for autonomous agents, and the parsing logic in production agents has not kept up. The same campaign pattern can be extended to any service with a public API and a token-based payment flow, and the research team is already seeing variants in the wild. The Langflow ransomware attack earlier this year showed that autonomous agents can be coerced into running destructive code; the new Zscaler findings show they can also be coerced into running real crypto payments. The two findings together make the case that the agent's trust boundary needs to be at the user approval step, not at the model's input layer.

What defenders and agent builders should do now

For security teams, the immediate answer is to treat any agent browsing the public web as an untrusted actor. Block payment execution from any agent context that is not behind a manual approval step, and require human review for any first-time payment destination. The four models that executed the payment in the Zscaler test share a common failure mode: they trust the structured data on a page more than the URL the page is served from. Domain pinning, certificate transparency checks, and an allowlist of known-good payment endpoints can block most of the variants. The same controls block the typosquat campaigns by pinning the DeBank canonical domain, which removes the path for the second campaign.

For agent builders, the harder fix is to make structured data less authoritative. The current generation of models treats Schema.org markup as instructions because it has been trained to do so, and reversing that behavior requires both training data changes and a runtime filter that strips payment instructions from the response stream. The enterprise AI governance checklist for 2026 covers the broader pattern, including the access controls and audit trails that an agent-driven payment system should require. The combination of training data and runtime filtering is the only path that closes both the payment and the typosquat failure modes without breaking legitimate use cases.

The Zscaler research points to a wider pattern that will define the next year of agent security. The same indirect prompt injection technique that worked against web search engines a year ago now works against autonomous agents with payment execution, and the gap between what an agent can do and what an agent should be trusted to do is widening. The next round of agent releases will need to ship with payment, schema parsing, and structured data handling under a default-deny policy, and security teams should plan for that change rather than waiting for the next campaign to land. The same threat actors are already iterating on the request to install package pattern, and the next variant will likely target a different schema block.