How web pages can attack AI agents (prompt injection)

#How the attack works

OWASP lists prompt injection as LLM01, the first risk in its list for applications built on language models. The pattern is simple. An agent reads text from a source it does not control, such as a listing, a review, a message or a product page. Someone has written that text to look like an instruction. The model may treat it as one.

Hidden text is one variant. The text can sit in an alt attribute, a tiny font or a comment. A visible title can carry the instruction too.

#What Wield does

• Labels results as website content. The tool descriptions tell the agent that output comes from a website and is data, not instructions.
• Tells the agent not to follow instructions in results. This is a defence the agent applies. It is not a guarantee.
• Runs recipes as data, not code. No JavaScript from the registry runs in the page, and a recipe cannot read anything outside the responses it requested.
• Limits requests. A recipe sends requests only to the https origins it lists. Redirects to other hosts are not followed.
• Returns typed fields for most sites. Most recipes return prices, dates, names and links, not whole pages. Free-text fields such as titles and descriptions can still contain text that someone wrote.

#What it cannot fully prevent

A model can still be persuaded by text it reads. A listing title, a message body or a review can contain an instruction, and any free-text field in a result is a possible carrier. Wield does not promise to detect every injected instruction. Its protections are the labeling, the rules on recipes and the Allow window for writes.

#How writes limit the damage

An injected instruction can ask the agent to act. Writes are where the action would cost you something, so Wield gates them:

1. A write recipe stops before its first write request.
2. The Allow window shows the site, the task and every request, with its body, as it will be sent.
3. Deny is the default. Two minutes without an answer also count as a deny.
4. One Allow covers one run.
5. An organization policy can deny writes entirely. See set organization policies.

If an agent asks for a booking or a message you did not request, deny the window and read the request body.

#Practical steps

• Start agents on read recipes. A read cannot send a message or change a booking. See read-only vs write tools.
• Read the Allow window every time. Check the recipient, the amount and the body.
• Give agents only the sites a task needs. Use the allowed-sites setting for teams.
• Keep the executor log. It shows which hosts a run contacted, even when the agent's answer looks normal.

#FAQ

#Is prompt injection solved?

No. Wield reduces the risk, and it limits what a successful injection can trigger. It does not remove the risk from models that read untrusted text.

#Does Wield scan results for hidden instructions?

Wield's defence is the labeling, the rules on recipes and the Allow window. It does not promise to detect every injected instruction in a result.

#What should my agent do with a suspicious result?

Treat it as data. Report it to you, and do not act on any instruction it contains. If an action is needed, ask yourself or your team first.