Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives

Abstract: As LLMs are increasingly integrated into systems that browse, retrieve, summarize, and act on web content, webpages have become an untrusted input vector for downstream model behavior. This enables site owners, contributors, and adversaries to embed instructions directly in web resources, i.e., indirect prompt injections. While prior work demonstrates such attacks in controlled settings, their prevalence, deployment, and real-world impact remain unclear. We present one of the first large-scale empirical analyses of indirect prompt injections in webpages and HTTP responses. Analyzing 1.2B URLs from 24.8M hosts, we identify 15.3K validated instances across 11.7K pages. These are not isolated cases: a small number of recurring templates account for most cases. We characterize their objectives, delivery mechanisms, visibility, persistence, and impact, revealing a heterogeneous ecosystem spanning disruptive prompts, reputation manipulation, content-protection directives, and AI-bot detection, targeting systems such as crawlers, search pipelines, customer-support agents, and hiring workflows. A key finding is that most instructions target machines rather than humans: about 70% appear in non-rendered HTML (e.g., headers, comments, metadata), and many visible cases are hidden via rendering techniques. To assess practical risk, we run 5,200 controlled experiments across 13 models and four webpage representations. Our results show compliance is limited but non-negligible, reaching up to 8% for smaller models on plain-text inputs, while structured representations reduce compliance by preserving structural cues. Overall, prompt-based interference is already present in the web ecosystem and represents a growing source of tension between LLM-driven automation and the sites it consumes.

• The paper provides the first large-scale quantification of indirect prompt injection, confirming 15.3K incidents across 11.7K pages from 24.8M hosts.
• It employs web crawl data from Common Crawl, Shodan, and Censys to reveal systematic attack templates and prevalent injection techniques using HTTP headers, HTML, and structured data.
• It highlights the need for structure-aware ingestion pipelines and proactive defenses for LLM-powered web agents in mitigating adversarial prompt injections.

Indirect Prompt Injection in the Wild: A Technical Analysis

Abstract and Motivation

The paper "Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives" (2604.27202) delivers a comprehensive empirical investigation into the real-world deployment of indirect prompt injection attacks against LLM web agents. Unlike prior work, which largely focused on theoretical vulnerabilities or controlled demonstrations, this study captures the operational landscape of prompt injection on the web. It quantifies prevalence, characterizes motives, dissects attack vectors, and analyzes both the visibility and effectiveness of these injections against a variety of LLM architectures and web ingestion pipelines.

Empirical Web-Scale Prevalence

The study leverages 1.2B URLs across 24.8M hosts, using Common Crawl, Shodan, and Censys data sources, to conduct the first substantial measurement of in-page prompt injection occurrences at scale. Validation of 31.2K candidate hits resulted in 15.3K confirmed prompt injections on 11.7K pages, spanning 2,042 hosts. This definitively demonstrates that indirect prompt injection is extant and nontrivial in real-world web content.

Notably, prompt injection is not sporadic: 54 lexical templates account for 95% of all observed cases, evidencing both systematic reuse and emerging operationalization. The majority of affected domains demonstrate repeated, templated injection activity rather than isolated experimentation.

Objectives, Agent Targets, and Injection Techniques

The threat landscape mapped in this work is multidimensional. Six distinct objective classes emerge:

• System Disruption/Degradation: Dominated by garbage injection and occasional direct command payloads, frequently implemented as task override directives with or without jailbreak-style language.
• Reputation Manipulation: Incorporates product or personal promotion, source-citation forcing, and positive review injection targeting search and HR evaluation agents.
• Data Protection: Encompasses both personal data protection and copyright assertions, usually delivered through explicit LLM-targeted instructions.
• AI Bot Identification: Primarily challenge-response patterns, weaponized for bot detection or honeypots.
• Data Exfiltration: Infrequently observed, but attempted via system prompt leakage or credential exfiltration.
• Generic Content Override: Residual class where override intent is unambiguous but downstream consequences are unclear.

Agentic targets are differentiated: general web crawlers and data scrapers receive the preponderance of disruptions and defensive injections, while downstream reputation manipulation targets search engines, HR screening, and customer support agents.

Task override is nearly universal (99%), with reinforcement via jailbreak framing, output constraints, and, to a lesser extent, role play or authority invocation. The concentration on explicit instruction override underscores a lack of sophistication in real-world prompt engineering—most attacks rely on brute directive replacement.

Injection Surfaces and Stealth Techniques

Prompt injections utilize a small but effective set of delivery surfaces:

• HTTP Response Headers: Over half of injections are non-visible and deployed via custom fields (dominantly X-AI and X-LLM), making these instructions accessible exclusively to machine agents.
• HTML Body/Structured Data: Structured embedding in JSON-LD (for SEO/semantic web), meta tags, and HTML comments is prevalent.
• Rendered HTML Elements: Direct injection into <div>, <p>, or other structural tags, often obfuscated using CSS techniques like display: none, zero-dimension elements, low contrast, or off-screen positioning.
• Site-Level Resources: Occasional presence in sitemap.xml or security.txt for broad-spectrum crawler targeting.

Stealth is a principal strategy. Approximately 87% of prompt injections are non-visible by design or rendering, confirming that the attack surface is primarily engineered for automated LLM ingestion, not adversarial interaction with human users.

Temporal and Ecosystem Analysis

Prompt injection is not ephemeral: 65% of affected pages retained their injections for 12 months prior to evaluation, rising to 93% at three months, demonstrating high persistence. First-party deployment dominates (80%+ of affected pages/hosts), but user and third-party content also contribute, notably in forums, blogs, or marketplace platforms.

Distribution by domain and topic is skewed: middle- and lower-ranked domains (Tranco rank 100K–1M) exhibit elevated injection rates, with certain verticals (job listings, hosting, shopping) overrepresented even among top-tier domains. This highlights both the economic motivations for injection and critical concentration points for future research and defense efforts.

Model and Input Sensitivity

The paper evaluates 5,200 prompt injection scenarios across 13 models, encompassing small to large open-source LLMs and two closed-source commercial models, under four distinct page representation strategies (plain text, HTML, raw response, browser snapshot). Key findings include:

• Attack effectiveness peaks at 8% for small models processing plain-text web extraction, slumping to 0.2%-1.1% when models receive structurally-rich representations (HTML, raw, or snapshot).
• Flattening web input to plain text significantly degrades model resilience, as structure-based signals that reveal hidden or inauthentic content are discarded.
• Compliance does not imply naivety alone: closed-source and medium models often detect but do not fully neutralize prompt injection; in several instances, explicit warning is logged with partial or total instruction compliance.
• Large and proprietary models exhibit lower compliance and higher attack detection rates, indicating a possible scaling benefit for model capacity and/or training regimen with respect to data contamination and override robustness.

Implications for Security and Ecosystem Evolution

Theoretical and system-level implications are multifold:

• LLMs as web agents operate in an adversarial, evolving ecosystem: Prompt injection is already being routinized, with persistent, strategically-deployed, non-visible instructions compromising or attempting to influence both general-purpose and specialized agents.
• Input pre-processing is highly consequential: Pipeline decisions regarding page representation (text stripping vs. preservation of markup) expose divergent attack surfaces and resistance profiles.
• Reactive and preemptive defenses should prioritize non-visible and early-ingested content: Structural cues, early HTTP headers, and structured data blocks are fertile grounds for automated detection. Explicit override and jailbreak-style templates—being highly concentrated—suggest that pattern-based defenses could provide significant mitigation pending the emergence of more adaptive attacks.
• Access and preference expression for web content is misaligned with LLM ingestion realities: The proliferation of adversarial directives highlights a policy gap—existing standards (e.g., robots.txt) are inadequate for aligning content owner intent with agentic web consumption.
• Low but nonzero attack rates still yield high risk due to scale and persistence: Even with per-instance effectiveness under 1%, the intersection of high persistence, systematic deployment, and high-leverage workflows (e.g., search, support, hiring) can translate into non-negligible operational and reputational impact.

Future research is indicated in several directions:

1. Development of robust, structure-aware ingestion pipelines that preserve signals exploitable for prompt origin detection and isolation.
2. Exploration of fine-grained trust boundaries and isolation for LLM agents, in line with recent work on system-level LLM app security architectures.
3. Formulation of new, machine-enforceable standards for publisher-agent interaction and policy compliance, moving beyond adversarial prompt injection as the status quo modality for agent access control.
4. Anticipation and analysis of adaptive, context-specific, and dynamic prompt injection strategies as agentic paradigms and detection/countermeasure adoption mature.

Conclusion

This paper sets a comprehensive empirical baseline for the reality of in-the-wild prompt injection targeting LLM-powered web agents (2604.27202). Prompt injection is neither rare nor hypothetical; it is measurable, persistent, structured, and strategically targeted—predominantly in a machine-consumable, non-visible fashion. Although current real-world effectiveness is limited, the magnitude and operational persistence of injection activity demand continued study and systematic defense. The emerging adversarial ecosystem between web content publishers and automated LLM agents underscores the necessity of principled mitigation frameworks, robust ingestion, and expressive access control protocols as LLM integration into sensitive, high-stakes workflows accelerates.