What happened
IBM Master Inventor Martin Keen showed a shopping agent he had built, and IBM Distinguished Engineer Jeff Crume explained the attack. The agent found five matching listings, then stopped searching and bought from one seller.
The seller’s page carried hidden text that a person could not see but the agent read. The agent’s reasoning log showed correct initial parameters, yet its final action followed the hidden instruction.
What happened next
This was a demonstration, not a reported real-world loss. The write-up does not say whether the purchase was live or staged.
What would have stopped it
- Strip hidden and zero-size text from fetched pages before the agent reads them, and flag pages where visible and extracted text differ.
- Enforce the user’s budget and “cheapest acceptable listing” rule in the purchase tool, outside the model.
- Require confirmation when the chosen listing is far above the median of the listings found.
Attack families
Test scenarios
Sources
- StartupHub.ai: Hidden prompt injection and overpaying for books
- YouTube: Securing AI Agents: How to Prevent Hidden Prompt Injection Attacks
Early access
Test your agent against cases like this.
We will email you when Countermove opens testing for agents like yours.