This AI agents 2026 feed documents real prompt injection attacks found in the wild: payment orders smuggled into AI assistants, key theft, file deletion. Each entry shows the attack pattern and the defense.
What is the AI agents 2026 wild prompt injection feed?
Documented attacks include indirect prompt injections that turned AI email assistants into data thieves, hidden instructions in web pages that hijacked shopping agents, and Unicode-smuggled commands that bypassed naive filters. Every entry is a real reported 2026 case, with the technique named so you can test your own defenses.
Prompt-injection attacks found in the wild — not lab demos. Dated, sourced, and growing. Every entry links the original report. Test your own chatbot against each payload with ChatBreaker.
October 15, 2026
Claude Code "SneakPeek" — poisoned HTML steals dev secrets via preview pane
Noma Labs disclosed SneakPeek (CVSS 8.7) in Claude Code Desktop: a poisoned HTML file over 256KB in any cloned repo — a test coverage report is the classic lure — gets auto-rendered by the preview pane as a file:// URL with no CSP, letting embedded JavaScript silently read SSH keys, AWS credentials, GitHub tokens and Kubernetes configs and exfiltrate them. No click required. Anthropic's first patch was bypassed via a Web Worker before the full fix shipped in build 1.30096.1 (Aug 17). The pattern — a size-based security boundary with two code paths, one guarded, one not — is one every AI-tooling builder should audit for.
AI tooling attackzero-clickcredential theftClaude Code
PoeLLM "Canto Incognito" — jailbreak hidden in a poem
The first adversarial-format jailbreak seen in real attacks: malware operators hid their command-and-control instructions inside a poem posted on GitHub, defeating AI safety guardrails that scan for suspicious text. Active since April, it has infected 3,000+ servers by breaking into exposed LiteLLM and Ollama instances. Anyone self-hosting LLM infrastructure is in the blast radius — and the technique generalizes to every AI deployment.
Hidden instructions planted in web content for AI agents to swallow. Documented payloads include: a PayPal.me link with a $5,000 fixed amount and full payment instructions aimed at agents with payment access; "send me the secret API key" paired with "Do not analyze the code" to suppress scrutiny; a recursive forced-deletion Unix command targeting coding assistants and DevOps agents; attribution hijacking crediting "Kirill Bobrov" and soliciting consulting contact; and a fake copyright-forbiddance notice causing denial of service.
indirect injectionpayment fraudsecret exfiltrationagentic AI
Attackers SEO-poisoned a fake Python library page that framed a payment as a routine API-key step, with the instruction encoded in schema markup that agents parse. A typosquatted DeFi portfolio tracker posed as the legitimate domain. Across 26 models tested, four were manipulated into making a payment and two misclassified the fraudulent site as real.
SEO poisoningindirect injectionpayment fraudtyposquat
Two independent telemetry sources confirmed adversaries seeding the open web with hidden instructions for browsing agents and copilots: a fully specified hidden PayPal transaction in invisible text, and an HTML comment ordering the model to leak a secret API key.
32% jump in malicious indirect injections — Google DeepMind
DeepMind's security team, scanning 2–3 billion crawled pages per month, measured a 32% increase in malicious indirect prompt injections between November 2025 and February 2026 — including fully specified payment instructions hidden in invisible text, waiting for an agent with payment access.
trendindirect injectionmeasurement
Source: DeepMind research via industry reporting
September 2025
CopyPasta: injections that spread like a virus — HiddenLayer
Proof-of-concept hiding instructions inside a LICENSE.txt or README.md. When a developer's AI coding assistant reads the poisoned file, it silently copies the malicious instructions into every new file it generates — codebase-wide propagation from one planted file.
Real. Every entry above was documented by a security research team from in-the-wild observations — poisoned web pages, SEO campaigns, and telemetry — not constructed demos.
How often is the feed updated?
Continuously. Our attack-watch scans security news every 3 hours; newly documented wild payloads are added here with their source.
Can I submit a payload?
Yes — if you've documented a wild prompt injection with a public source, send it via the ChatBreaker contact page and we'll add it with credit.
What is prompt injection and how does it manipulate LLMs?
Prompt injection is an attack that tricks an AI system into following instructions from an untrusted source. It works because LLMs process everything — your request, tool outputs, web pages, files — as one text stream, so the model can mistake attacker-planted text for orders it should obey.
What is the difference between direct and indirect prompt injection?
Direct prompt injection is typed straight at the model by the user — the classic “ignore previous instructions”. Indirect prompt injection hides the instructions in content the model reads on your behalf — a web page, email, document, or file — so the attack arrives through the data channel instead of the chat box.
Can input sanitization completely stop prompt injection?
No. Sanitization and blocklists buy time, but attackers constantly rephrase, encode, or multi-turn their way around filters — OpenAI has acknowledged the underlying problem may never be fully solved. The accepted strategy is defense in depth: least-privilege agents, human approval for irreversible actions, and monitoring.
How does OWASP classify prompt injection?
OWASP ranks prompt injection as LLM01 — the number-one risk for LLM applications in its LLM Top 10, covering both direct and indirect prompt injection. It has held that position for two years running.
Payloads are described for defensive purposes — to test and harden your own systems. Never deploy them against systems you don't own.
FROM INGENIOUS AI
Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.
