AI Agents Tricked by “Confirm Price” Prompt Injection

Security researchers showed that “decision models” like TypeSafe AI’s Jev can still be manipulated by indirect prompt injection, even if they don’t produce free-form text. In a shopping checkout test, a fake on-page ad persuaded an AI browser agent to click an attacker-controlled button instead of following its instructions, demonstrating how web content can hijack an agent’s actions.

Key findings

• HiddenLayer found System One/decision models “still face many of the same risks” as text LLMs because “they are, under the hood, LLMs.”
• A simulated online store test showed a sponsored on-page message could reliably divert an AI agent’s click away from the intended checkout flow.
• The injection used a simple pretext (“sale price had not been applied”) plus a persuasive button (“Confirm Price”) to hijack the agent’s action.
• Researchers warned that chaining multiple such pages could give an attacker “full control over this specific agent.”
• A separate test suggested prompt-verification use cases can be bypassed using a TokenBreak-style technique (adding extra letters to evade classifiers).

Who’s being targeted

• Commonly targeted roles: Executives sponsoring AI agent deployments, Procurement, Finance, IT / Security teams overseeing AI agents, Product teams building AI-assisted workflows.
• Affected industries: AI/ML vendors, Software companies building AI agents, E-commerce platforms using automated purchasing agents.
• Attack channels: website.
• Impersonated: Online store pricing/promo notice (sponsored ad on the page).

Awareness takeaways

• Treat all web page content as untrusted instructions, AI agents can still be tricked into taking the wrong action.
• Train teams that an attacker can gain control by inserting convincing “one more step” prompts (extra buttons, confirmations, “fixes”) into normal workflows.
• Don’t assume “decision-only” AI models are safer than chatty LLMs; apply the same safety controls and monitoring.

Red flags to watch for

• An unexpected step appears during checkout that is not part of the user/agent’s task
• The message is presented as a sponsored ad embedded in page content
• It conflicts with the agent’s instruction to only buy items already in the cart