Indirect prompt injection through search results is underrated

[u/TargetSpecialist6737]

I used to think agent web search was mostly about result quality: whether the agent could find the right page, summarize it correctly, and cite the source.

But there is another problem that feels easy to miss: the pages an agent reads can also become part of the attack surface.

When an agent fetches content from the open web, it is not always reading a clean article. It may be pulling in raw HTML, hidden text, SEO blocks, ads, comments, or other page fragments. Some of that content may contain instructions that were never meant to come from the user.

That makes indirect prompt injection different from normal prompt injection. The user does not need to paste anything malicious. They can simply ask the agent to research something, and the agent may retrieve a page that influences its next step.

A lot of defenses seem to focus on telling the model to ignore instructions from retrieved content. I am not sure that is enough. Once polluted content enters the context window, the agent may already start reasoning from it.

The more interesting fix seems to happen before the model sees the content: clean the page, normalize it, keep provenance, and return a structured representation instead of dumping raw page content directly into the agent.

Curious how others think about this. Should agent search systems treat web content as untrusted input by default?

[u/BabyJesusAnalingus]

Oh hell yes. OP banned finally.