Two pieces of research published in September 2026 mark a shift in how prompt injection should be treated. Unit 42, the research arm of Palo Alto Networks, described web-based indirect prompt injection observed in the wild against AI agents that browse and act. Check Point disclosed a technique it calls PuzzleMask, which embeds a policy-violating payload inside fluent, properly formed text rather than the encoding anomalies, invisible Unicode and emoji smuggling that most detection is tuned to catch.
The direction of travel is the same in both cases: the attack now targets agents that take actions, and it arrives inside content the agent was asked to read.
Why it matters
A chatbot that can be talked into saying something embarrassing is a content problem. An agent that browses, reads email, files tickets, runs code or moves money is a different category, because a successful injection converts into an action with consequences.
The economics also favour the attacker. Injected instructions do not need to be delivered to a target — they wait in a web page, a document, a review or a support ticket for an agent to fetch, and the same payload works against every agent that reads it.
How it works
Indirect prompt injection places instructions in content the model consumes rather than in the user's message. Because current language models do not reliably distinguish trusted instructions from untrusted data in their context window, text that says what to do can be obeyed regardless of where it came from.
PuzzleMask's contribution, per Check Point's write-up, is evasion of detection rather than a new capability: by hiding the payload in fluent, natural language it sidesteps classifiers built to spot encoding oddities. That undercuts the common assumption that an input filter meaningfully reduces the risk.
Evidence
Unit 42's report, "Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild", documents the activity against browsing agents. Check Point's blog post of September 10, 2026 describes PuzzleMask as a newly disclosed technique that embeds a policy-violating payload inside fluent, proper text and sidesteps detection built around encoding anomalies, invisible Unicode and emoji smuggling. SecurityWeek's September 8, 2026 feature on hidden instructions that hijack AI agents makes the same point about scale and speed, and Help Net Security's September 3 report on SANS and AWS guidance argues directly that an agent's system prompt is not a security control.
What defenders should do
Treat everything an agent reads as untrusted input, and put the security boundary outside the model. That means enforcing permissions in the tools the agent calls rather than in its instructions: scoped credentials per tool, allow-lists for destinations, and hard limits on spend, data volume and blast radius that hold no matter what the model decides to do.
For anything irreversible — payments, deletions, outbound email, production changes — require human approval or a second, independently authorized check. And log the retrieved content alongside the action taken, because without the source text an incident review cannot establish what instructed the agent.
What happens next
Expect more observed-in-the-wild reporting as agent deployments grow, and expect vendors to ship containment features — capability scoping, approval gates, provenance labelling of retrieved content — faster than they ship detection, because containment is the part that can actually be made reliable. Anyone waiting for a model that cannot be injected will be waiting a while.