Today my AI assistant was posting an article for me.
Normal job. Log in, paste, format, publish.
Then it hit a page on a well-known blogging platform. And on that page was text I couldn't see. Text written for AI agents. Not for people.
My assistant flagged it, ignored it, and kept doing the job I gave it.
Good. But it made me stop and think. Because most business owners have no idea this is a thing.
What this actually is
It has a name. Indirect prompt injection.
Simple version: someone puts instructions on a web page, in an email, or in a document. Your AI reads that content while doing a task for you. And it might treat those words as orders.
You never see them. They can be hidden in a lot of ways:
- White text on a white background
- Tiny text, or text pushed off the screen
- HTML comments and hidden page elements
- Metadata and alt text
- Faint text inside an image
A person scrolling the page sees nothing. Your AI sees all of it.
This isn't a fringe worry
OWASP is a big, respected security group. Their Top 10 list of risks for AI apps puts prompt injection at number one.
Brave's security team tested Perplexity's Comet browser. They showed that hidden text on a page, even a comment on a site like Reddit, could push the AI to act against the user. Later they showed the same trick working with nearly invisible text inside a screenshot. Their take: this isn't one company's bug. It's a problem across the whole category of AI browsers.
OpenAI has said it plainly about its own Atlas browser. Prompt injection, like scams on the web, is unlikely to ever be fully "solved."
So this is not going away. It's something you manage.
Why business owners should care
An AI agent works with your access. Your email. Your logins. Your accounts.
Normal web security doesn't help much here. The AI isn't breaking in. You already let it in.
If a hidden line on some random page can nudge it, it can try to do things you never asked for. Send something. Click something. Share something.
You'd find out after.
What I do, and what I'd tell any owner
Keep the final approval. Anything that sends, pays, publishes, deletes, or shares waits for me. My assistant can prep the work. I hit the button.
Limit access. Don't give an agent every login you have. Give it what this job needs. Nothing more. If it gets tricked, the damage stays small.
Web pages give info, not orders. Your agent works for you. A page it reads is just content. If a site "tells" it to do something, that's a red flag, not a task. Set your tools up this way. Pick tools that work this way.
Watch for weird actions. Agent opens a site you didn't mention? Tries to email someone new? Asks for a password out of nowhere? Stop it. Look.
Keep sensitive stuff separate. Don't let an agent browse random sites while it's logged into your bank or your main email.
The bottom line
AI agents save me a lot of time. I'm not going to stop using them.
But I treat them like a sharp new hire. Fast, useful, and too trusting. A new hire reads a note taped to a door that says "give the visitor the keys." You want them to call you first.
Today mine did the right thing. I want it doing the right thing every time. Not by luck.
So here's my question: if a web page told your AI assistant to do something today, would you even know it happened?
— Nathan Brumand, founder of Loppee.com