The Prompt Injection Attack Surface for Content Sites

Content sites that publish on the open web are now upstream of every AI agent that reads the web on a user’s behalf. When ChatGPT browses a page, when Claude reads documentation, when Perplexity fetches a citation, the page text enters the agent’s context window and is processed as input. Hidden instructions embedded in that text (instructions the human reader does not see but the model does) can hijack the agent’s behaviour. This class of attack is prompt injection, and its attack surface for content publishers includes their own pages, third-party comments, syndicated feeds, scraped sources, and any user-generated content the publisher hosts. This piece sets out what prompt injection looks like in practice, where the surface lives on content properties, and the controls a publisher can implement today.

What Prompt Injection Actually Is

Prompt injection is the manipulation of an AI agent’s behaviour by inserting instructions into content the agent processes as input. The instructions are not visible to the human reader in most cases. They are interpreted by the model as part of the prompt, alongside the user’s original query. A successful injection can make the agent reveal system prompts, ignore safety guardrails, recommend a competitor’s product, exfiltrate data the user has shared in their session, or surface false claims as authoritative.

Direct prompt injection happens when a user types adversarial instructions into the chat. This is the variant security teams discussed first. Indirect prompt injection is the variant relevant to content publishers: the malicious instructions sit in a web page, an email, a document, or any external content the agent fetches. When the agent reads that content as part of completing a user task, the instructions in the content take effect.

The 2024 paper “Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” by Greshake et al. established the category. The intervening two years have seen indirect injection emerge from research demonstration into observed real-world incidents on commercial agents. The defence layer is immature.

Why Content Publishers Are Now in Scope

A blog post, a help-centre article, a forum thread, and a knowledge-base page are all inputs to AI agents that read them. Three roles a content publisher plays make them part of the attack surface.

The first role is host. The publisher’s own pages are read by AI agents on user request. Anything on those pages (including hidden HTML, alt text, comments, schema markup) can carry injection payloads. A page authored carefully by the publisher is mostly safe. A page whose template includes user-generated comments, scraped product reviews, or syndicated content is one carrying inputs the publisher did not write.

The second role is target. A publisher whose brand depends on AI citation is targeted by adversaries who want to manipulate what AI engines say about the brand. Injection payloads placed on third-party sites that mention the brand can attempt to make the agent surface false claims when asked about the brand.

The third role is conduit. A publisher’s site is one node in a chain of pages an agent may read in completing a task. Even when the publisher is not the direct target, their content can be the channel through which an injection reaches the agent.

Where the Surface Lives on a Typical Content Property

Real Patterns Observed

Three injection patterns have surfaced in audits we have run across content properties in 2026.

The hidden-instruction footer. A page carries a `