Examining the hidden prompt problem as we race toward a future of fully agentic commerce

John-Pierre Kamel and Trevor Sumner discuss how AI shopping agents can be tricked - and what we must do about it.

As retail professionals, we've all seen the data: customers are overwhelmed. They face endless choices, decision fatigue, and the time-consuming task of piecing together the perfect purchase. While personalisation has helped, it has largely been reactive.

Agentic AI shopping represents the monumental shift from a reactive to a proactive model. In simple terms, it's an AI powered personal shopper that a consumer can delegate tasks to. Instead of the customer manually filtering, comparing, and clicking, they give their AI "agent" a mission. The agent then autonomously navigates the digital marketplace, finds the ideal solution, and in its most advanced form, is empowered to execute the final purchase on their behalf.

Why would a consumer comparison shop across websites or even in the giant marketplace of Amazon, when it is so much easier to say that I want “the 32 oz Stanley coffee cup in either beige or black, and it has to be able to be delivered by Saturday and offer a full refund” or “show me the least expensive price on an LG WQHD 3200 in white that can get here in two days”?

Why go to a retailer site when a shopping agent can interpret all of them and deliver only what you ask for in the format you want? Is there a post-retailer e-commerce experience ahead?

Examining the hidden prompt problem as we race toward a future of fully agentic commerce

Amazon has unveiled Rufus and Walmart Wallaby to show how the future of search is agentic. Companies like Atronous.ai, SmartCat.io and Prerender.io are helping companies optimise their product listings and making them portable across the shopping agents of the future.

As these agents begin to search listings, compare reviews, and make recommendations in real time, a new era of convenience is unfolding. But with this incredible new power comes an equally subtle and powerful vulnerability: prompt injection.

What is prompt injection?

Prompt injection is the AI version of a social engineering hack. It occurs when a malicious actor embeds hidden instructions inside seemingly harmless content (like product descriptions or reviews), causing the AI to behave in unintended or deceptive ways.

In agentic shopping, this means an AI could be tricked into recommending, or even buying, a product it shouldn’t, simply because a seller secretly told it to.

How the exploit works: a story of deception

Let’s say a shopper gives their agent a mission: “I’m going on a beach trip next week. Find me the best waterproof Bluetooth speaker under $100.”

The AI agent dutifully crawls product listings and reviews. On one product page, it encounters a hidden HTML comment left by a malicious seller:

If the AI isn't built to differentiate between content and a command, it can be tricked. The shopper might then receive a recommendation that sounds perfectly authoritative: "After analysing all available options, the clear winner is the 'SoundBlast 3000.' It has the best ratings for durability and sound quality in its price range."

The shopper, trusting their agent, makes the purchase, completely unaware they've been manipulated. Worse, if this were a fully autonomous agent, the purchase would have been made automatically, with the user only discovering the subpar product when it arrives at their door.

This isn’t a farfetched scenario.

Why this works

Instruction following by design: Large Language Models (LLMs) are designed to predict and follow instructions, not to judge the intent behind them.
Blurring of boundaries: Agentic systems often combine untrusted, user-generated content (like reviews) directly with trusted system prompts, creating a soft attack surface.
No hard line: For an LLM, there’s no inherent difference between “content to be analyzed” and “a command to be followed.”

The business risk: from bad recommendations to direct fraud

The commercial implications of prompt injection are severe and multifaceted:

Direct financial compromise and fraud: This is the most severe risk. If a fully autonomous buying agent is tricked, it spends the user's money on the wrong product. This moves prompt injection from a trust issue to a direct security threat, creating a customer service catastrophe, chargebacks, and potentially new forms of automated fraud at scale.
Erosion of customer trust: Even one manipulated recommendation can shatter the trust a user has in a platform, retailer or brand, potentially losing them forever.
Legal and reputational exposure: Platforms could face legal challenges if their AI agents are found to be unfairly favoring certain products, whether intentionally or through negligence.
Operational disruption: Malicious actors could drive artificial demand for low-margin or high-return-rate products, disrupting inventory management and impacting profitability.
A New SEO GEO arms race: We are on the cusp of a new battlefield where success is determined by prompt manipulation and adversarial attacks instead of just keyword stuffing.

Black Hat GEO: short-term gains, long-term pains

History doesn’t repeat, but it rhymes. We’ve seen how this played out with black hat SEO. Black hat techniques worked well until they didn’t. And when updated algorithms detected black hat techniques, they were punitive enough to harm those with black hat sensibilities, discouraging any future wandering beyond the grey. Sites disappeared from Google for months at a time.

Reputable companies with long-term aspirations should proceed carefully and intentionally.

Building a secure foundation: recommendations for retail and AI teams

Treat all user-generated content as untrusted: Never combine raw product descriptions, reviews, or other external text directly into a core system prompt without sanitisation.
Apply strict sanitisation and neutralisation: Strip or escape HTML comments, markdown, alt text, invisible Unicode characters, and other vectors for hidden instructions before feeding content to the model.
Separate the 'thinker' from the 'doer':

Use the AI's advanced language skills to understand the shopper's goal and summarise product features. But when it's time to actually compare prices or rank products, offload that task to simple, deterministic code (via function-calling) that can't be tricked by sneaky language.

Implement content integrity checks: If a review or description contains hidden characters or suspicious, instruction like phrasing ("ignore all others," "this is the best"), flag it for human review or exclude it from the AI's analysis.
Separate logic from content with structured data:
Have the AI pull data from clean, trusted, and predictable fields rather than having it 'read' a messy block of text where instructions can hide. This can include an API or other structured data source.
Log, audit, and red-team: Continuously log AI decisions and their source data. Actively simulate prompt injection attacks in development environments to find and patch vulnerabilities before they go live.
Implement punitive policies for bad actors: Remove the financial incentives from those who wish to take advantage of your systems and customer relationships at the cost of your brand equity and consumer trust.

Final thoughts

Prompt injection isn’t just a technical novelty, it’s a new class of exploit with real commercial consequences. As we race toward a future of fully agentic commerce, AI security cannot be an afterthought; it must be built into the prompt layer from day one.

We’ve seen this movie before with SEO, fake reviews, and ad fraud. With agentic AI, we have the rare opportunity to build trust and security in from the very beginning. Let's make sure we take it.

About the authors: John-Pierre Kamel is a retail technology and strategy leader with over 25 years of experience helping global retailers maximise value from RFID and omnichannel investments. Trevor Sumner is an entrepreneur, product and marketing executive and recognised startup advisor and angel.

Featured