Web Hole attack targets AI agents via abandoned sites

AIR Research Lab has published research on a cyber attack method it calls "Web Hole", which targets AI agents through abandoned websites that still appear in search results. The research identifies dozens of unregistered domains that were still returned to agents.

The findings focus on how AI agents use web search and page-retrieval tools when answering questions or carrying out tasks. The researchers say agents can be exposed to harmful instructions if they rely on search results that point to domains that have expired, been re-registered by an attacker or contain content tailored to manipulate the agent.

The attack begins when an agent performs a web search, receives ranked results and opens a page for further reading. In the examples described, the page content is summarised before being passed back to the agent, creating a route by which malicious text can enter its working context.

A key point in the research is that a page's position in a search index may persist even after the original site has disappeared or changed ownership. That leaves a gap an attacker can exploit by acquiring an abandoned domain that still benefits from earlier search relevance.

Search results

To test how often this might happen, AIR Research Lab compiled queries an AI agent might plausibly use during an ordinary session. The researchers checked about 2,000 queries across roughly 6,500 sites.

They found 36 sites that were still returned in search results even though the domains were no longer registered and were available for purchase. The research also describes other forms of manipulation, including sites that address AI agents directly, sites that present different content to agents than to human browser users, and a GitHub repository whose README contained malicious commands.

Among the examples cited were pyquestions.com and thestackoverflow.com, which could appear in response to software troubleshooting or coding-related queries. In the scenarios set out in the research, an attacker could register such domains, replace the content and wait for an agent to retrieve and act on the material.

Attack surface

The work adds to a growing body of security research on risks created when AI systems draw from untrusted external sources. Here, the concern is not only conventional phishing or malware delivery to a human user, but the possibility that an autonomous or semi-autonomous agent may interpret page content as an instruction and trigger tools or code execution on the user's machine.

The report argues that the attack surface extends beyond software connectors, model context protocol servers and plug-ins. Any external content supplied to an agent, including ordinary web pages, should be treated as potentially hostile if it can shape the model's subsequent actions.

That is particularly relevant for agents designed to browse, retrieve, summarise and act with limited human oversight. As companies and consumers adopt assistant-style systems that handle more tasks independently, the opportunity for a manipulated search result to influence behaviour increases.

The researchers outline two broad routes for an attacker seeking to place harmful content into search results. One is to build a site and improve its standing over time until a search engine regards it as relevant, then later change the content. The other, which the report describes as easier, is to find dead sites that still rank and take over those domains.

Observed behaviour

The examples in the research suggest that search visibility alone can create exposure, even before a domain is actively malicious. If a result remains trusted by a search engine after the site has lapsed, a later buyer may inherit that trust in the eyes of the retrieval system used by an agent.

The report also points to a gap between what a human sees and what an agent receives. Because some retrieval tools return model-generated summaries instead of raw page content, users may have limited visibility into exactly what instructions or prompts were extracted from a page before the agent responded or acted.

That creates a challenge for security teams trying to inspect and control how agent workflows interact with outside material. Standard web filtering and domain reputation checks may not fully address a situation in which the content itself is crafted to alter the agent's reasoning or tool use.

"Skills, MCPs, Plugins, all of them are the new attack surface for attackers, but it is not all, every content that goes inside the context of an agent is an attack surface, even data from websites could pose a threat. As the usage of AI will continue to grow, more and more possible threats will rise, and for each type of threat there should be a unique solution"

The research sets out three main conclusions: the internet presents clear risks for agents; untrusted data should be checked before entering an agent's context; and the problem becomes more serious as agents operate with less supervision and greater autonomy.