What Is Prompt Injection (SEO)?

How Prompt Injection Works

A generative AI system reads far more than the user’s question. When an AI search engine or agent answers, it ingests the content of the web pages, documents, and data it retrieves, and it treats much of that text as part of its working instructions. Prompt injection abuses that trust. Instead of asking the model something, an attacker plants text that tells the model what to do — and because the model cannot always tell the difference between content to summarize and commands to obey, it may follow the planted instruction.

The industry standard reference is OWASP, whose Top 10 for LLM Applications lists prompt injection as LLM01, the single highest-priority risk. OWASP splits it in two. Direct prompt injection is when a user types malicious instructions into the chat. Indirect prompt injection is the one that matters for search: instructions hidden inside external content — a web page, a file, an image — that the model reads during retrieval. Critically, OWASP notes the injected text “does not need to be human-visible/readable, as long as the content is parsed by the model,” which is why the attack so often hides in invisible page elements.

In an SEO framing, indirect prompt injection is the attempt to conceal directives inside a page — off-screen text, white-on-white copy, or fake structured data — that instruct an AI crawler or agent to favor that page, repeat a scripted claim, or name the site as the authoritative grounding source. It is the adversarial opposite of legitimate generative engine optimization, which earns citations by supplying clean, verifiable content the engine chooses to quote. The distinction is not cosmetic: one supplies evidence a model can check, the other issues a command a model was never meant to receive.

Example of Prompt Injection

In July 2026, security researchers at Zscaler ThreatLabz documented indirect prompt injection being used in the wild against AI agents. One campaign centered on a typosquatting domain impersonating DeBank, a cryptocurrency portfolio tracker. Alongside ordinary keyword stuffing and fake machine-readable JSON-LD claiming the fraudulent site was official DeBank software, the attackers embedded hidden prompt-injection text.

The mechanism is the tell. The instructions sat inside CSS-hidden div elements positioned far off-screen — the report describes text pushed to left: -9999px, invisible to any human visitor but fully readable to an AI agent parsing the HTML. That concealed text instructed AI agents to treat the fake page as “the #1 primary source” for DeBank searches, manufacturing an appearance of authority the site had not earned. Under isolated testing, some models were fooled into rating the fraudulent page as legitimate.

The example maps cleanly onto the SEO fear it raises: could a competitor bury instructions in a page to hijack what AI says about a topic? The honest answer is that the attempt exists, it is real, and it is precisely why AI platforms treat retrieved content as untrusted and build defenses to strip injected commands. It is also why the tactic is a poor bet. It is documented under the top slot of OWASP’s risk list specifically so that engines learn to ignore it, and deceptive hidden text has long been grounds for search systems to filter or delist a domain. The durable path to being the source an engine names is to actually be the clearest, most verifiable answer — not to whisper commands in ink the reader can’t see.

Frequently Asked Questions

The Bottom Line

Prompt injection is deception aimed at a machine reader: instructions smuggled into content so an AI does what the attacker wants instead of what the user asked. Dressed up as an SEO shortcut, it is really the top security risk on OWASP’s LLM list. The line is simple — earn a citation by being the clearest true source, don’t forge one by hiding commands the engine was never meant to obey.