Google DeepMind Exposes AI Agent Traps That Let Hidden Web Instructions Control Autonomous Agents

Autonomous AI agents can browse the web, read emails, make purchases and invoke tools on a user’s behalf. But they also process HTML, CSS, image metadata and dynamic content that people cannot see. This turns online information from a data source into an attack surface. If malicious content is mistaken for an instruction, an agent could leak data, conduct unauthorized transactions or even spread the contamination across multi-agent systems.

Google DeepMind researchers completed “AI Agent Traps” on March 8, 2026, and uploaded it to SSRN on March 28. The study identifies six categories of traps—content injection, semantic manipulation, cognitive state, behavioral control, systemic and human-agent collaboration—spanning major models and agent architectures. In some test scenarios, web-based prompt injection achieved a manipulation rate of as much as 86%, highlighting gaps in agent defenses.