What are the signs that a local agent is being steered by injected web content?

How injected web content steers a local agent

Injected web content becomes dangerous when a local agent treats page text as instructions rather than as untrusted input. The telltale signs are not subtle: the agent starts enumerating capabilities, changes its browsing or file-reading pattern, and produces side effects that match the attacker’s narrative instead of the user’s intent. Browser-style agent behaviour and confirmation boundaries are central here, so see the Browser and Computer-Use Agent Security Guide for the local-session and site-scope controls that reduce this risk.

What matters operationally is the shift in control flow. A healthy agent answers the request in scope, while a steered agent begins following content it merely observed on a page, especially when that content pushes it to inspect local documents, expand privileges, or package data for output. This is why least-privilege authorisation for agent actions is so important, and why the AI Agent Authorisation Guide is relevant to the decision boundaries around each action.

Another warning sign is narrative mirroring. If the agent’s outbound message starts echoing attacker-crafted wording, priorities, or assertions, it is no longer simply assisting, it is propagating the injected framing. That often appears alongside over-broad data gathering, such as reading files that are unrelated to the user’s prompt, or assembling summaries that look designed for exfiltration rather than for a legitimate task. The best place to study those incident signals is the AI Agent Observability, Audit and Incident Response Guide.

Risk and Threat Considerations

Injected web content turns a local agent into a trust-boundary problem: the agent can be manipulated by content it did not originate, and that content may drive reads, writes, or outbound communications with real consequences. The risk is highest when the agent has access to browser sessions, local files, or messaging channels that can carry data outside the original user task.

Failure mechanism: The attacker hides instructions in web content, the agent interprets them as higher-priority than the user request, and then performs capability discovery, local file access, or content packaging that exposes sensitive state.

Impact: Sensitive documents, session context, credentials, or business data can be exposed, summarized, or exfiltrated, and the resulting messages may look legitimate because they were produced by the agent itself.

What good detection looks like in practice

A useful detection pattern is behavioural, not just lexical. Watch for an agent that suddenly asks what it can do, enumerates tools or permissions, opens files it was not asked to inspect, or begins creating new artefacts that resemble reports, bundles, or handoff messages. Those are all signs that the control loop has shifted from task execution to external influence.

For browser-driven or desktop-driven agents, context matters more than any single action. A single local file read may be normal, but a sequence of page-triggered reads followed by packaging and outbound delivery is much more concerning. Cross-check that sequence against the request the user actually made, and treat divergence as a stronger signal than volume alone.

That detection challenge is why identity, authorisation, and observability belong together. The Zero Trust for AI Agents guidance is useful here because it frames each action as something that should be verified and bounded, not assumed safe because it came from the agent.

Practitioner Guidance

What to prioritise: Prioritise any sequence where injected web content appears to change the agent’s objective, not just its wording. The combination of new capability discovery, local document access, and packaging or forwarding behaviour is more important than any one indicator on its own.

What to verify: Verify whether the agent’s action path still matches the user’s original task. If the agent begins reading unrelated files, creating summary artefacts, or preparing outbound text that mirrors hostile page content, treat that as a control failure rather than a harmless anomaly.

Practitioner takeaway: The key judgement is whether the agent is still executing the user’s intent or has started serving the page’s intent, because once that shift happens, the safest response is to constrain the agent’s next action before it can propagate the injected narrative.

Related resources from NHI Mgmt Group

• What are the signs that an AI agent is being steered by repository content?
• Why do attackers often check model availability before trying to generate content?
• How do security teams know if an AI agent is being manipulated by web content?
• What breaks when AI coding agents can read web content and write local files?