Citizen Lab published something the security industry had long assumed was possible but had never caught in the wild: zero-click spyware delivered through an ordinary targeted ad, a technique it calls AdFection. Candiru’s spyware infected at least 45 devices at Al Jazeera after a banner bought by an Israeli ad company called Discover-Tech rendered on screen. Nobody clicked a link or opened an attachment. The ad loaded, and the device belonged to someone else.
The reaction has split along predictable lines. Spyware people see a spyware story and adtech people see an adtech story. Both miss the part that matters: how precisely the ad picked its victim. The people who most need to understand that precision are the millions of us who handed an AI agent the keys to our browser this year. Point the same targeting at an agent and you don’t need spyware. A prompt injection attack is enough.
Malvertising as a targeting machine
Every banner you see comes out of an auction that lasts a fraction of a second. During it, your device broadcasts its advertising ID, its IP address and the app or site you’re using to anyone willing to bid. Discover-Tech bid. Its ads carried a small script that phoned home with those identifiers. For almost everyone, the server sent back nothing at all, zero bytes. For a chosen device, it sent back code. A researcher or an ad-network scanner loading the same ad saw a harmless banner.
Citizen Lab counted nearly four billion bids. The ads ran in some 200,000 apps and websites, including Viber, Yahoo Mail, Duolingo and a Muslim prayer app, and turned up inside NATO, UN and European Parliament networks. For six years, Discover-Tech sat on Google’s certified vendor lists and IAB Europe’s consent framework.
Take away the spyware and what’s left is a targeting machine: pick one device among billions and hand it a payload nobody else will ever see. Google has now cut Discover-Tech off. The machine is still running.
Also Read: Securing AI Agents in Enterprise IT Environments: Best Practices for Managing Security Risks
The AI browser agent reads the ad too
On January 28, Google started rolling out “auto browse” in Chrome, a Gemini-powered agent that opens tabs, clicks, fills in forms and, once you let it, signs into websites with your password manager. OpenAI’s ChatGPT agent and Perplexity’s Comet do much the same. These agents work by reading the page, all of it, ad slot included. They can’t reliably tell content they should act on from content that just happens to be there.
The UK’s National Cyber Security Centre calls language models “inherently confusable deputies” and has warned that this flaw, prompt injection, may never be fully fixed. Brave’s researchers have already pulled off working injections against Comet and Opera’s Neon. Anthropic, testing its own browser agent, was blunter: “No browser agent is immune to prompt injection.”
Ad auctions give prompt injection a targeting system
Until now, indirect prompt injection has had a targeting problem. The attacker has to plant instructions on a page and hope the right agent wanders past. Phishing has the same weakness. That targeting gap is a big reason most prompt injection demos so far have been proofs of concept rather than real campaigns.
The ad auction solves that problem. Anyone with a demand-side platform account can bid on impressions from a particular company’s IP range, or on a cookie collected from a particular person on an earlier visit. The winning ad renders in the tab the agent is reading. The payload is just a paragraph telling the agent what to do next. The attacker needs no vulnerability, only an agent doing its job.
That makes the second version of AdFection far cheaper than the first. An exploit chain that beats a modern browser costs millions and dies the day it’s patched. A well-written paragraph costs nothing, and no browser update will ever patch it.
Ads inside the assistant
Ads are also arriving inside the assistants themselves. OpenAI started placing ads under ChatGPT replies in February. Within six weeks the pilot had passed $100 million in annualized revenue, and by the end of August it had reached a $1 billion run rate. OpenAI says the ads won’t influence responses. Maybe not. But AdFection shows that a buyer with a clean-looking front can sit inside a certified ecosystem for six years. Every ad-funded assistant inherits that supply chain, whether it wants to or not.
Asking before it buys protects the wrong thing
The vendors will point out that their agents stop and ask before buying anything. They do. But what Al Jazeera lost was access and data. For an agent, the dangerous verbs are read and send: summarize this inbox, open that shared drive, pull the customer list from the CRM tab, post the result to this address. None of that trips a purchase confirmation. Researchers have already made a browser agent lift a private email address from a site the user was logged into and hand it to an attacker. Confirmation prompts protect the actions a vendor imagined. Attackers pick the ones it didn’t.
Four unglamorous defenses against prompt injection
There’s still time before the first confirmed case. Start by treating the ad slot as hostile input to any agent, and run agent sessions with content and DNS blocking switched on. Citizen Lab recommends ad blockers for people at risk, and the case is stronger for software that reads every word on the page. Next, take away standing credentials. Give each agent its own browser profile with no password manager, and a scoped login only where it can’t be avoided.
Keep an inventory. In the AI governance assessments my firm runs, the inventory is the first control to fail. Companies list the customer chatbot and the coding assistant and forget the browser agent a salesperson switched on last month with the CRM open all day.
Finally, assume the injection will succeed. Log what agents read and where they send it, and require approval for sensitive reads as well as purchases. Make sure someone can shut an agent off within minutes. The joint guidance that CISA, the NSA and their British, Canadian, Australian and New Zealand counterparts published in May makes the same point: fold agents into the security frameworks you already have, and never let one hold broad access.
Conclusion: prompt injection only needs an ad bid
AdFection proved the ad supply chain can single out one device and serve it something nobody else sees. Put that next to browser agents, which act on text they find on a page while holding a user’s logins, and you get a cheap way to hijack an agent on a single chosen device. The ad industry still owes an explanation for how a company Citizen Lab ties to spyware delivery stayed on its vendor lists from 2020 until October 2026. Agent vendors need to stop treating the confirmation prompt as a security boundary. Companies running agents shouldn’t wait for either. For them, AI agent security starts with what the agent can read and reach, and how fast someone can switch it off.
Nobody has published a prompt injection delivered through an ad yet. But both halves exist, and the second is cheaper than the first. The people best placed to combine them have already shown they can pass as certified ad vendors for years. The first zero-click attack of this kind needed a mercenary spyware firm and a browser exploit. The next one will need a bid and a paragraph.
Ali Hayat is the chief executive of Axipro, a compliance and cybersecurity consultancy with offices in Bahrain, London and the United States.
