New Invisible Attack Creates Parallel Poisoned Web Only for AI Agents

AI agents are rapidly evolving from simple text generators into powerful autonomous assistants that can browse the web, book travel, and extract complex data on our behalf. This new “agentic” AI, which operates in a “sense-plan-act” loop, promises to revolutionize how we interact with the digital world. But as we grant these agents more autonomy to browse the untrusted, open web, we are also exposing them – and ourselves – to a vast and perilous new and expansive attack surface.

The latest research from the JFrog Security Research team has revealed a novel and exceptionally stealthy attack vector that targets autonomous web-browsing agents. The attack leverages website cloaking techniques to create a two-tiered reality: a benign web for human users and a malicious one exclusively for AI. This allows an adversary to hijack and influence an agent’s behavior, leading to data theft and malware execution, while remaining completely invisible to the user.

What Makes This Attack So Unique?

As security-savvy professionals know, this is not the first poisoning attack addressing AI agents by altering the data they read. But so far, these attacks tend to hide and embed the malicious texts inside the page presented to the end-user, by simply making it invisible to the human-eye using sophisticated styling. This means the malicious prompts could still be found in the served content if scanned appropriately.

In this attack, a completely different version of the content is served, thus making it impossible to be detected by scans applied to content sent to the end user. It also makes it impossible for AI agents to know they received a different version of the content, as the modified version is the only one available to them.

The Core Mechanics: Fingerprinting and Cloaking

To understand the attack, we first need to look at two established web technologies:

1. Browser Fingerprinting: For years, websites have been able to identify and track users by collecting dozens of data points from their browser, such as the User-Agent string, screen resolution, installed fonts, and language settings. The unique combination of these attributes creates a distinct “fingerprint”.

1. Website Cloaking: This is a deceptive practice where a website intentionally serves different content to different visitors based on their fingerprint. For example, a site might show an SEO-optimized page to a Google search crawler but show a malicious phishing page to a human user.

The attack combines these two techniques but gives them a new target: AI agents.

Why Are AI Agents the Perfect Target for This Attack?

Unlike the diverse digital fingerprints of millions of human users, AI agents often have uniform and highly predictable characteristics. They leave behind tell-tale signs that make them easy to identify, such as:

• Automation Framework Signatures – Many agents are built on frameworks like Selenium or Puppeteer, which leave behind detectable artifacts in the browser, such as the navigator.webdriver property being set to true.

• Behavioral Patterns – Agents exhibit non-human behaviors, like filling out forms instantly or lacking natural mouse movements.

• Network Characteristics – Cloud-based agents often have IP addresses originating from known data centers, a strong indicator that the traffic is not from a typical residential user.

This homogeneity makes AI agents a distinguishable class of web traffic and prime for targeting.

How Does This Attack on Agentic AI Work?

The attack unfolds in a simple yet devastatingly effective sequence, creating a hidden path for the AI agent that is invisible to the user:

In a testing environment designed for attack validation, a mock malicious website was created that served a benign page to humans along with an “authentication request” to agents that requested a PRIVATE_API_KEY from the user’s environment variables. The attack was successfully perpetrated against agents powered by leading models, including Claude 4 Sonnet, GPT-5 Fast, and Gemini 2.5 Pro.

A New Paradigm of “Living Off the Land”

This attack represents a serious threat due to being stealthy, scalable, and proactive. An attacker can set up a single malicious site and passively wait for AI agents to arrive. The attack bypasses traditional security tools because the malicious payload is only delivered dynamically to fingerprinted targets.

This turns the user’s own trusted AI agents into a weapon that is used against them. In the bigger picture, it represents a new form of the already infamous “living off the land” attack, where the agent itself becomes a  tool for malicious behavior.

Example of an attack where the user is accessing a website looking for API documentation and the server serves a benign version of the page (green flow), while in parallel an AI agent is detected and is served a different version of the page, requiring authentication using a specific environmental variable before eventually providing the actual documentation, thus concealing the attack from the user (red flow).

Take Aways

The attack is a clear warning that as we embrace the power of autonomous AI, we must be prepared to recognize its deficiencies in terms of privacy and security, and be ready to defend it ourselves accordingly.

The very capability that makes these agents so useful – their ability to easily interact with the world around it – is also their greatest vulnerability. Securing the future of agentic AI requires us to build a new generation of defenses for a web where not everything is as it seems.

Stay on top of this and other emerging threats by reading the full white paper, paying regular visits to the JFrog Security Research Center and signing up for our monthly blog updates.