Over the last 30 days, the dominant theme is the explosive evolution of prompt injection attacks via HTML/CSS, targeting AI agents and extensions. XSS, once just for cookie theft, now enables zero-click hijacking of AI tools with full access—via malicious pages, iframes, or invisible HTML comments—succeeding up to 86% per Google DeepMind research. Surprise: These "invisible" vectors like hidden comments make auditing nearly impossible, turning any untrusted web data into a weapon.

Strong consensus across X posts: Indirect prompt injection is an escalating threat to complex AI apps, with real-world demos of malicious HTML pages bypassing safeguards. Contrarian take from Reddit: Ironically, even benign raw HTML in prompts spikes token costs 3x and tanks output quality, underscoring why LLMs mishandle it. Meanwhile, YouTube chatter hypes agent-building tools, but ignores these security pitfalls.

Bottom line: As AI agents proliferate, HTML-based attacks are the new XSS nightmare—build fast, secure faster.

Most Mentioned

• Hidden/Indirect Prompt Injection — 7 mentions
  Consensus: Malicious HTML/CSS (comments, iframes) hijacks AI agents via untrusted web content; zero-click via XSS; 86% success rate (DeepMind); hard to audit due to invisibility.
  Sources: [1], [2], [3], [6], [7], [9], [13]
• AI Agents — 5 mentions
  Focus: Building autonomous agents with tools like Cursor/Claude; hype around open-source predictors (MiroFish) and inter-agent negotiation; security risks from prompt injection under-discussed.
  Sources: [2], [5], [6], [7], [10], [12], [15]
• XSS Evolution — 2 mentions
  Shift from stealing cookies to injecting prompts/full tool access in AI extensions/agents.
  Sources: [1], [2]

Key Patterns

1. Invisible Attack Vectors — Hidden HTML comments and CSS enable stealthy prompt injection, evading human audits while fooling AI parsers.
2. Zero-Click Exploitation — Malicious pages trigger via simple visits/XSS, no user interaction needed, amplifying real-world risk to AI browser extensions/agents.
3. High Efficacy — DeepMind benchmarks show 86% success; techniques bypass safeguards in production AI apps like Google Workspace.
4. Raw HTML Downsides — Even non-malicious HTML bloats tokens 3x and degrades LLM outputs, explaining vulnerability root causes.
5. Agent Hype vs. Security Gap — YouTube pushes rapid agent building (e.g., 30-min tutorials), but X warns of injection flaws in the same ecosystems.