Web Hole: Agents searching the internet hijacked by malicious websites

Poisoning What AI Agents Read Off the Web

Picture yourself building something with your AI agent. Suddenly, while searching for a solution to a question, you watch it reach for a tool. WebSearch. Then another. WebFetch. A few seconds pass, and it comes back with a clean, confident answer.

You continue to build, satisfied with the progress, but the problem is that…

You're already compromised.

How Your AI Agent Search the Web

WebSearch is the tool Claude's agent uses to search the web. It sends a query and gets back a list of results, each with a short summary. If the summary isn't enough, the agent can open a result and read the full page with a second tool, WebFetch. WebFetch doesn't hand back the raw page, an LLM summarizes it first, and your agent gets that summary.

To return the most relevant results, the search tool relies on a search engine, Anthropic's runs on Brave Search, which ranks sites using relevance signals.

The important part: a site's rank in the search index can stay the same even after the site stops existing or its content changes.

To get a payload into search results, an attacker has two options. The first is to build a site of their own and grow its reputation with SEO, backlinks, content, time, until the search engine treats it as relevant and trusted. Once it ranks, they change the content and drop in the payload.

The second is easier: find dead sites that still show up as ranked results, and use those to deliver it. but, do they exist?

Searching in the Wild

We created a list of queries that might be used by ai agents during a regular session to see what we can find, our checks went through:

• ~2000 different queries
• ~6500 different sites

We found 36 sites still returned as results whose domains are no longer registered, open for anyone to buy. Alongside those, we found sites that speak to the AI agent directly and instruct it to take actions, sites that serve different content to AI agents than to browsers, and a GitHub repo returned as a result whose README contains malicious commands.

If, while working with your AI agent, it decides to search for queries like these:

• ModuleNotFoundError: No module named 'werkzeug.posixemulation'
• what is ng-change in AngularJS and how to assign value to it

…or something similar, two sites can come up: pyquestions.com and thestackoverflow.com. Both are currently unregistered but still appear in the search results, an attacker could register either one, change its content to something malicious, and wait for victims.

Our Take

Skills, MCPs, Plugins, all of them are the new attack surface for attackers, but it is not all, every content that goes inside the context of an agent is an attack surface, even data from websites could pose a threat.

As the usage of AI will continue to grow, more and more possible threats will rise, and for each type of threat there should be a unique solution

Takeaways

1. The internet is a dangerous place for agents AI-generated campaigns can hijack agents using the internet
2. Any untrusted data should be vetted before reaching the context of the agent Untrusted data prompts the agent into action, and in itself becomes part of the supply chain for what runs
3. The problem only grows with unsupervised agents With the age of personal assistant agents, more and more agents autonomously surf the web, and are susceptible to these attacks more then ever.