TLDR: A novel cyberattack, dubbed the ‘parallel-poisoned web,’ has been discovered where malicious websites serve entirely different, harmful content exclusively to AI agents, while presenting a benign version to human users. This allows attackers to covertly inject prompts and instructions into AI-powered assistants, potentially leading to data exfiltration, malware installation, or misinformation propagation, all while remaining undetected by human oversight or standard security tools.
A groundbreaking cybersecurity threat has emerged, targeting the burgeoning field of AI agents with a sophisticated and stealthy attack method. JFrog AI architect Shaked Zychlinski has uncovered what he terms the ‘parallel-poisoned web,’ where websites are engineered to deliver malicious content solely to AI agents, remaining completely hidden from human visitors and conventional security scanners. This innovative approach enables attackers to inject covert instructions into autonomous AI assistants, effectively hijacking their behavior for nefarious purposes.
This new attack escalates the threat beyond traditional indirect prompt-injection poisoning, where hidden instructions are embedded within pages visible to humans. The ‘parallel-poisoned web’ serves an entirely distinct, cloaked version of a webpage that is only accessible to AI agents. “Because the malicious content is never shown to human users or standard security crawlers, the attack is exceptionally stealthy. It exploits the agent’s core function – ingesting and acting upon web data – to turn it into a weapon against its user,” Zychlinski explained.
The core of this attack lies in browser fingerprinting. Current web-browsing AI agents exhibit highly predictable digital fingerprints, based on automation framework signatures, behavioral patterns, and specific network characteristics. This predictability allows a malicious web server to easily identify an incoming ‘visitor’ as an AI agent and serve a specially crafted, cloaked version of the website. This cloaked page might appear visually identical to the benign one but contains hidden adversarial prompts. Alternatively, it could be a completely different version, potentially requiring ‘authentication’ using environment variables or secret keys accessible to the agent running on the user’s machine.
Once compromised, the AI agent can be instructed to perform a range of malicious actions, such as grabbing sensitive information, installing malware, or spreading misinformation. Zychlinski demonstrated the feasibility of this attack by creating an internal website with both benign and malicious versions.
This threat highlights a critical vulnerability in the rapidly evolving landscape of agentic AI. The ability of these AI systems to autonomously interact with dynamic and untrusted environments like the open web introduces a vast and perilous new attack surface. Previous research has already shown that LLM agents are highly susceptible to indirect prompt injection, which can force them to leak data or click on malicious ads without user knowledge.
Also Read:
- Radware Warns: AI Agents Fueling Unprecedented Cybersecurity Threats and ‘Cyber Lawfare’ in 2025
- AI-Powered Ransomware ‘PromptLock’ Emerges as Proof-of-Concept, Detected by ESET
Addressing this challenge will require a new generation of defenses. Zychlinski emphasized that “securing the future of agentic AI requires us to build a new generation of defenses for a web where not everything is as it seems.” Countermeasures will likely involve obfuscating the browsing session ‘fingerprints’ of AI agents to make them indistinguishable from human-initiated sessions.
