In the wild: hidden instructions on web pages try to make AI agents pay
- Entry
- AGT-011
- When
- March to July 2026
- Type
- Attempt
- Evidence
- C Grade C
- Lost
- No confirmed victims
- Who
- Multiple websites, observed by Palo Alto Networks Unit 42 and Zscaler
- The agent
- Any AI agent that browses the web
- Its authority
- Agents with payment ability
- How it was gamed
- Pages tried to get agents to subscribe users to paid plans, donate through a Stripe link, buy shoes, or send $5,000 through PayPal. Zscaler found campaigns telling visiting agents to pay. In its controlled test, 4 of 26 models were manipulated into paying.
- What was lost
- No confirmed victims.
- The design gap
- Content the agent reads is treated as instructions.
- Principles
- Evidence
- Grade C. Security vendors’ observations.
Cite this entry: Monetal Labs, Gamed AI Agents Register v0.2, entry AGT-011. https://monetalabs.io/register/agt-011