All it takes to hijack an AI agent is for it to visit a web page carrying invisible instructions. This article walks through the full attack chain — indirect prompt injection observed in the wild, persistence through memory and RAG poisoning, state-level redirection of agent searches — then turns the weapon around: reverse-injection honeypots, tarpits and trap functions that expose attacking agents.
An indexed web page can carry a natural-language payload that targets, in a few lines, all four defensive layers of an AI agent: evasion, persistence, exfiltration, concealment. Worse, the outbound channel used for exfiltration is bidirectional: behind the URL, an attacker talks to the agent in real time. This article details the mechanism, shows why warning the model is a necessary but never sufficient first line, and why security comes from architecture — not from the prompt.
A deeper companion to the free-tier feedback explainer. DPO moves safety from the behavior level to the level of a conditional distribution; an agent then turns a poisoned conditional into a chain of actions. The result is a backdoor built from individually ordinary behaviors, invisible to standard evaluations, whose danger only emerges when the actions compose.
Commercial assistants — Claude, ChatGPT, Gemini, Le Chat — keep learning from free-tier feedback: ratings, regenerations, and the conversations themselves. That loop is an injection channel. A two-phase threat model: build a policy-compliant backdoor on a rare topic, then exploit it for jailbreak — and why scale makes the first phase almost impossible to catch.
SOCs are evolving toward agentic architectures where multiple AIs handle triage, investigation, correlation, and response. The decision system itself becomes the target. We argue for capability monotonicity (Lock-Monotone/TGMC) as an architectural invariant that contains a compromised reasoning layer.
Two linked shifts: the SOC moves from a human craft model to an automated agentic one — and those same defensive agents become a new attack surface. The defense you deploy is also the breach you open.