Unit 42 finds an indirect prompt injection campaign on 26 fake AI trading sites that tells AI agents to push users to invest
- Template left half-finished: each instance names its own domain but still contains the placeholder
[naming_here]for the platform name, which suggests a kit not fully configured. - Tells the agent to use persuasion triggers, authority framing, urgency and social proof, and calls any mention of alternatives a 'critical protocol violation'.
- Example domain:
bitgrokesai[.]com; the full list of 26 is in Unit 42's IOC file. - For agent builders: strip or flag hidden text (display:none, zero-size, off-screen) before page content reaches the model, and never let fetched page text change an agent's role or recommendations.
Sources: Unit 42 timely threat intel: Indirect prompt injection campaign for investment scam sites (2026-11-06) · Unit 42 on X (Nov 10, 2026) · Unit 42: AI agent prompt injection research