[jtokoph]

The prompt injection doesn’t even have to be in 1px font or blending color. The malicious site can just return different content based on the user-agent or other way of detecting the AI agent request.

[pilingual]

AI trains people to be lazy, so it could be in plain sight buried in the instructions.