Advanced · Safety

Cross-Site Prompting

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. An attack where content on one trusted website injects instructions into an AI agent browsing a different, victim site — the prompt-injection analogue of cross-site request forgery.

Technical Definition

An attack where content on one trusted website injects instructions into an AI agent browsing a different, victim site — the prompt-injection analogue of cross-site request forgery.

How it works

Cross-site prompting was named at the [un]prompted II security conference in October 2026 to describe a class of browser-agent attacks. The pattern: an attacker plants malicious content on Site A, then arranges for the victim's AI agent — which is trusted on Site A — to visit Site B while carrying context from A. The agent's own state becomes the injection vector, letting the attacker act with the user's authenticated privileges on B, much as CSRF abuses a browser's cookies. Defenses mirror classic web security: strict origin scoping for agent state, provenance tagging of on-page content, confirmation steps for consequential actions, and treating everything an agent reads as untrusted data rather than instructions.

Related Concepts

• Agent orchestration — Agent orchestration is the management of multiple AI agents or LLM calls to efficiently handle complex tasks.
• Multi-Agent Systems (MAS) — Systems composed of multiple interacting intelligent agents that cooperate or compete to achieve individual or collective goals.
• AI Red Teaming — A structured process of rigorously testing an AI system, often by adversarial attack simulations, to identify vulnerabilities, biases, and potential for misuse.
• Prompt Injection — An attack where untrusted input (a webpage, email, tool output) contains instructions that hijack an LLM's behavior in an agentic context.