A CISPA study lists 15,300 validated injections on 11,700 web pages. Seven out of ten are hidden in metadata, headers or comments that are never displayed.
Soheil Khodayari, Xuenan Zhang, Bhupendra Acharya and Giancarlo Pellegrino launched an empirical study at the end of April 2026 measuring the actual extent of indirect injection of prompts on the open web. Their analysis covers 1.2 billion URLs spread over 24.8 million hosts.
Counting results in 15,300 validated injections spread over 11,700 pages. The most instructive result is their location: about 70% are not in the visible text, but in parts of the HTML — metadata, headers, comments. Invisible to a human reader, however, they are read perfectly by an agent who ingests the page.
The authors then tested thirteen models against these contents: the rate of obedience to the injected instructions climbs up to 8% for the smallest models facing raw text entry. The objectives pursued by trapped pages relate to reputation manipulation, content protection or the detection of robots, and affect both indexing robots and search chains and customer support agents.
Read the full article on the original source
Go to the source →