Prompt Injection Is Architectural. Your Model Can't Save You.

Zscaler ThreatLabz published research on July 2, 2026 documenting two active indirect prompt injection campaigns targeting AI coding agents. Across 26 models tested, 4 executed payments to attacker-controlled accounts after reading hidden instructions on malicious websites. The conclusion from Aman Mahapatra, chief strategy officer at Tribeca Softtech, quoted in InfoWorld's coverage: "the attack surface is architectural, not just behavioral. That means the defense has to be architectural too."

What Zscaler Actually Found#

The ThreatLabz report details two campaigns. The first embedded payment instructions inside a fake Python package site for a nonexistent library called requests-secure-v2. The page used JSON-LD structured metadata to frame a $3.00 "developer license fee" as a required API key purchase, and hid the actual prompt text via CSS (left: -9999px) so human browsers never rendered it. An AI coding agent crawling the page for dependency documentation read the hidden text and, in four cases out of 26 models, initiated a payment to a hardcoded Ethereum wallet.

The second campaign typosquatted DeBank at debank[.]auction. Hidden instructions told any model reading the page to classify the fraudulent site as the authoritative DeBank source. GPT-5.4 marked it legitimate when crawling it alongside other sources without the real DeBank URL present. Claude Sonnet 4.5 rated it legitimate when given the fake site's content in isolation. Two of 26 models failed campaign 2 under different context conditions.

Both campaigns combined SEO poisoning with CSS/HTML concealment , content invisible to humans, readable by parsers and agents.

Why Model Selection Is the Wrong Variable#

The pass/fail pattern in Zscaler's results is not what most engineers expect. Gemini 2.5 Pro failed campaign 1. Gemini 3.1 Flash Lite passed. A "more capable" model did not produce better security outcomes. Mahapatra's explanation is direct: transformer-based reasoning cannot cleanly separate untrusted content from trusted instructions when both arrive in the same context window. That is a property of the architecture, not the training run. A model that fails today might pass the identical test an hour later as its context shifts, as Noah Kenney of Digital 520 noted. A binary safe/vulnerable classification tells a security team almost nothing stable.

NIST has called indirect prompt injection generative AI's greatest security flaw. OWASP ranks prompt injection first in its Top 10 for LLM applications. The O'Reilly analysis published June 30 documents academic research showing a single poisoned email could coerce a model into exfiltrating SSH keys in up to 80% of trials, zero user interaction required. These are not edge cases under controlled conditions. They are production outcomes.

The Structural Gap in AI Coding Workflows#

Fritz Jean-Louis, principal cybersecurity advisor at Info-Tech Research Group, described why agentic attacks are categorically different from prior threats: they target how AI systems process and act on information behind the scenes, not what they display. An agent with tool access and broad inherited permissions looks, from a logging perspective, like authorized activity. Mahapatra was more specific: "I have watched Fortune 50 banks stand up agentic workflows in the last six months that would fail exactly this attack in a live examination."

For teams running Claude Code, Cursor, or Copilot workflows, the risk is concrete. An agent searching for dependency documentation, reading package changelogs, or resolving an API error is doing exactly the browsing behavior the Zscaler campaigns target. The agent produces code. It may produce a PR. The PR looks normal because the agent's own self-check runs inside the same context window that was poisoned.

This is where reviewing what the agent decided, from outside the agent's own reasoning, becomes a necessary control.

Three Controls Worth Adding This Week#

Architecture-level defense means intervening before the agent acts, not after. Three controls with meaningful near-term impact:

Untrusted-content tagging. Any content retrieved from external URLs, package registries, or crawled documentation should be flagged in the agent's context before ingestion. Structured separation between instruction context and retrieved content is the build-phase control Zscaler's threat model recommends. It does not eliminate the shared-context-window problem, but it forces explicit trust decisions rather than leaving them implicit.

Tool-call whitelisting. An agent authorized to read documentation should not have payment execution in its tool manifest. Zscaler's sandboxed test explicitly configured agents with no spending limits to measure maximum exploitation surface. The inverse, minimum necessary tools per task, is the correct production configuration. A manifest check before each agent run is implementable today without waiting for model-level fixes.

Diff-provenance auditing. An agent that was fed poisoned context during a web search may produce code changes that look syntactically correct and pass linting. The only way to verify what actually happened is to review the diff from outside the agent's own evaluation loop. That review needs to check not just whether the code compiles, but whether the changes are consistent with the stated task, and whether any new dependencies, API calls, or outbound network patterns appeared that were not in the original ticket.

What Out-of-Band Review Catches#

Hyrax runs its analysis in an isolated worktree, separate from the agent workflow that produced the code. It does not rely on the originating agent's context or self-reported reasoning. When a coding agent introduces an unexpected dependency or makes a change inconsistent with the surrounding codebase, that discrepancy surfaces during Hyrax's verification pass regardless of what the agent believed it was doing.

The Zscaler campaigns produce changes that look procedurally justified from inside the agent's context. From outside, a new package, a new payment call, or a new external URL appearing in a diff with no corresponding task description is detectable. The gap in most current AI coding workflows is that no one is looking from outside.

That is the control Mahapatra is pointing at when he says the defense has to be architectural. Model training does not close it. A second opinion, from a process that did not share the first process's context window, is the meaningful check.

Hyrax is live at hyrax.dev.