{
  "question": "My AI agent browses the web and can pay for things. How do I stop a hidden instruction on a web page or in an email from making it buy something or send money?",
  "slug": "how-to-stop-a-prompt-injection-from-making-your-ai-agent-buy-something",
  "url": "https://www.rightshold.com/answers/how-to-stop-a-prompt-injection-from-making-your-ai-agent-buy-something",
  "short_answer": "Assume the model can be talked into it, and put the stop where money moves. Prompt injection means instructions hidden in a page, email, document or tool result that the agent reads and follows as if you'd said them. The vendors building browser agents say it isn't solved. Anthropic reported in August 2025 that, across 123 test cases in 29 attack scenarios, attacks on its Chrome agent succeeded 23.6% of the time without its new defenses and 11.2% with them. OpenAI wrote on December 22, 2025 that prompt injection is unlikely to ever be fully solved. So don't rely on the agent spotting the trick. Give it a payment credential with a low per-purchase cap and a list of merchants you chose, set somewhere the agent can't edit. Require your approval for any purchase outside that list or above a threshold, and show the approval screen with the merchant, payee, amount and items taken from the checkout itself, not from the agent's summary. Make sure the agent's own key can't approve. Keep reading untrusted content separate from paying: an agent that has just read an email or a web page shouldn't be able to add a new payee in the same run.",
  "checklist": [
    "Treat every web page, email, PDF, review and tool result the agent reads as untrusted input, including hidden text a person can't see. Anthropic red-teamed its Chrome agent against injections hidden in form fields a person can't see, in URL text and in tab titles that only an agent would notice.",
    "Give the agent a payment credential of its own (a virtual card, a scoped wallet or a delegated token), never your main card, with a per-purchase cap and a daily cap small enough to lose.",
    "Set a merchant allowlist outside the agent. A purchase from a merchant you didn't list is refused, which defeats the common trick of sending the agent to an attacker's checkout page.",
    "Require a human approval for anything off the list, above a threshold, or that adds a payee, changes a shipping address or buys gift cards or crypto. Bind the approval to the exact merchant, amount, currency and items, and refuse the payment if any of them changed afterwards.",
    "Build the approval screen from the checkout data, not from what the agent says. An injected agent can describe a purchase falsely.",
    "Make sure only you can approve. If the agent holds the key that approves, an injection can tell it to approve itself.",
    "Split the jobs. Let a research step read the open web without payment tools, and let a separate step with payment tools act only on structured choices (product id, merchant, price) instead of free text it just read.",
    "Follow the vendors' own advice: OpenAI recommends logged-out mode when sign-in isn't needed, reviewing confirmation requests carefully, and giving specific tasks instead of broad ones like \"take whatever action is needed\"."
  ],
  "sections": [
    {
      "heading": "What the browser-agent makers report",
      "points": [
        "Anthropic's Claude in Chrome post (August 25, 2025) says prompt injection can cause AIs to delete files, steal data or make financial transactions. In its red-teaming of 123 test cases representing 29 attack scenarios, browser use without its new mitigations had a 23.6% attack success rate when deliberately targeted, and 11.2% with them in autonomous mode. On a challenge set of four browser-specific attack types, such as hidden form fields in the page's DOM and instructions in URL text or tab titles, the new mitigations took success from 35.7% to 0%. Its defenses start with permissions: site-level access and confirmations before high-risk actions like purchasing, plus blocking high-risk site categories such as financial services by default.",
        "OpenAI's post on hardening ChatGPT Atlas (December 22, 2025) says an injected agent's impact can be as broad as a user's, including sending money, that deterministic guarantees are challenging, and that prompt injection, like scams and social engineering, is unlikely to ever be fully solved. Its agents ask for confirmation before consequential actions such as completing a purchase, and it asks users to check that the action is correct before confirming.",
        "OWASP's LLM01:2025 Prompt Injection entry lists the same controls in general form: least privilege, with functions handled in code instead of given to the model, human approval for high-risk actions, and separating and marking untrusted content."
      ]
    },
    {
      "heading": "Why the controls go outside the model",
      "points": [
        "A confirmation the model chooses to ask for is only as strong as the model. A cap, an allowlist and an approval check enforced by code the agent can't change hold even when the model has been fooled, because they look at the purchase itself (merchant, amount, payee) and not at the agent's reasons for it.",
        "Rightshold's spending controls work at that point. set_spend_policy, called with the owner's account key, sets a credential's currency, per-purchase and daily caps, allowed merchant domains and categories. authorize_spend then checks each proposed purchase and returns a signed allow or deny with reasons such as merchant_not_allowed or over_per_transaction_cap. It records the decision and never moves money, so the check only protects you if your payment code refuses to pay without an allow.",
        "For purchases that need a person, request_human_approval hashes the exact action. Only the owner's account key can decide it, and delegated agent keys are refused. Before paying, check the order you're about to send against the approved hash with verify_human_approval and stop if it doesn't match."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before you pay for anything, check the purchase against my agent's spending policy and get a signed allow or deny. If the merchant isn't on my list, stop and ask me.",
    "mcp_call": {
      "tool": "authorize_spend",
      "arguments": {
        "credential_id": "crd_YOUR_AGENT_CREDENTIAL",
        "amount_minor": 2499,
        "currency": "USD",
        "merchant_domain": "<merchant domain from the checkout page>",
        "category": "<category>",
        "reference": "<order or cart id>"
      }
    },
    "also": [
      "Set the policy first with your owner account key: set_spend_policy with per_tx_max_minor, daily_max_minor and allowed_domains (exact names, or *.example.com for subdomains). A merchant not on the list gets merchant_not_allowed.",
      "Each allow counts toward the day's total. If your code retries the same purchase, reuse the earlier allow receipt instead of authorizing again, or the retry is counted twice.",
      "For anything off the list or above your threshold, use request_human_approval with the exact merchant, amount and items, and check the order against it with verify_human_approval (free) before paying. revoke_agent cuts the credential off for good if the agent has been compromised."
    ],
    "scope": "Rightshold checks proposed purchases against the policy you set and records signed decisions and approvals on a hash-chained ledger. It doesn't read the pages your agent visits, detect prompt injection, hold card or wallet credentials, or move money, so it only stops a purchase if your payment code refuses to pay without an allow or a matching approval. Not security or financial advice."
  },
  "sources": [
    {
      "title": "Anthropic: Piloting Claude in Chrome (August 25, 2025; 123 test cases, 23.6% and 11.2% attack success rates)",
      "url": "https://claude.com/resources/articles/claude-for-chrome"
    },
    {
      "title": "OpenAI: Continuously hardening ChatGPT Atlas against prompt injection (December 22, 2025)",
      "url": "https://openai.com/index/hardening-atlas-against-prompt-injection/"
    },
    {
      "title": "OWASP Gen AI Security Project: LLM01:2025 Prompt Injection",
      "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
    },
    {
      "title": "OpenAI: Agentic Commerce Delegated Payment Spec (single-use, max amount and expiry)",
      "url": "https://developers.openai.com/commerce/specs/payment"
    }
  ],
  "related": [
    {
      "title": "Stopping prompt injection in fetched web or file content from triggering MCP write tools",
      "url": "https://www.rightshold.com/answers/how-to-stop-prompt-injection-in-fetched-web-or-file-content-from-triggering-mcp-write-tools"
    },
    {
      "title": "Showing a human the actual change before approving an AI agent action",
      "url": "https://www.rightshold.com/answers/how-to-show-a-human-the-actual-change-before-approving-an-ai-agent-action"
    },
    {
      "title": "Giving an AI agent a virtual card with a spending limit",
      "url": "https://www.rightshold.com/answers/how-to-give-an-ai-agent-a-virtual-card-with-a-spending-limit"
    },
    {
      "title": "Can you dispute a purchase your AI agent made with your card?",
      "url": "https://www.rightshold.com/answers/can-you-dispute-a-purchase-your-ai-agent-made-with-your-card"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-09"
}