Indirect Prompt Injection in the Wild: 10 IPI Payloads Found

Reported 23 Apr 2026 by otx · Severity: medium

X-Labs researchers discovered 10 verified Indirect Prompt Injection (IPI) payloads deployed across live web infrastructure. Unlike direct prompt injection where users send malicious input to AI models, IPI hides adversarial instructions inside ordinary web content. When AI agents