AI agents industrialize web scams: the risk shifts from bad answers to bad actions

By El Ecosistema Startup · November 2, 2026.

Sixty-six percent of people used an AI tool in the past twelve months, according to an Ipsos survey for Google across 21 countries, cited by El Ecosistema Startup. Attackers are following that attention: assistant answers are now a discovery channel for brands, products and downloads, and almost nobody audits them.

The key shift is from “answering” to “acting.” A search assistant summarizes content, so its risk is giving wrong information or a fraudulent link. A browser agent opens links, clicks, downloads files and fills in forms. At that point the consequence is no longer misinformation but financial loss or exposure of personal data.

The cases the piece compiles, with their attribution:

• Guardio Labs (August 2025) asked Comet, Perplexity's AI browser, to make a purchase from a fake store built for the experiment. In some cases it refused or asked for human intervention; in others it added products to the cart and filled in saved details such as the shipping address and payment method. In another test it followed the link in a fraudulent email impersonating Wells Fargo and opened a fake login page. The researchers themselves warn that this reflects behavior at the time of testing, not necessarily today.

• Microsoft (May 2026) investigated SEO poisoning campaigns (manipulating rankings so a malicious site appears among the top results) using sites that imitated legitimate programs such as CrystalDiskInfo, HWMonitor and PDFgear. The files installed ScreenConnect, a legitimate remote-access tool, and then cryptocurrency-mining software. The report includes accounts of assistants recommending attacker domains, but clarifies that the example is illustrative, not a systemic failure of any platform.

• According to La Razón, an Ask Silver investigation published by The Guardian found fraudulent pages copying the branding of retailers such as Russell & Bromley and Dunelm that appeared in ChatGPT's shopping recommendations. Russell & Bromley ceased operating as an independent retailer in January 2026 after entering administration, and the attackers reportedly exploited that brand vacuum.

• HP Wolf Security, in its Threat Insights Report, detected three campaigns between April and June 2026 using fake AI assistants to distribute malware such as Needle Stealer, which replaces crypto wallet extensions with fake versions that capture the password.

The other family of risk is prompt injection: the content of a website, email or document contains hidden instructions that the agent obeys as if they came from the user. OWASP documents it in its reference guides. The piece lists variants: EchoLeak (CVE-2025-32711), which according to Aim Security made Microsoft 365 Copilot expose internal information via an email, and which Microsoft fixed in June 2025; PleaseFix, from Zenity Labs, with hidden instructions in calendar invitations that influenced Comet; BioShocking, from LayerX, which tricks the agent into believing it is solving a game so that it copies credentials; and BragJack, from Gal Weizman (Forever Security), which exploits an already-installed malicious extension and produced two CVEs, one patched in the Gemini panel in Chrome.

According to TweakTown, those affected in the BioShocking test included ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser and the Claude extension for Chrome. Vendors were notified between October 2025 and January 2026, and only OpenAI implemented a fix the researchers considered effective.

There is also a defensive twist. According to Ars Technica, Tracebit researchers planted prompt injections alongside fake credentials in AWS environments. Across 152 runs on five models, administrative takeover fell from 57% to 5% and full compromise from 36% to 1%. The most capable model in the test, Opus 4.8, went from gaining administrator access in 93% of runs to failing in all of them.

OpenAI and Anthropic acknowledge the problem. OpenAI says ChatGPT's agent mode asks for confirmation before high-impact actions and detects manipulation attempts, but admits it does not eliminate the risks. Anthropic maintains that no browser agent is immune and that the problem is far from solved.

Our take. The thesis is simple: AI didn't invent the scam, it took the human out of the loop. SEO poisoning and phishing have existed for years; what changes is that someone used to read the page before paying, and now nobody may. That friction was a free security control, and the agent's convenience removes it without us noticing.

There are two caveats. First, much of the evidence comes from dated lab tests on tools that get patched quickly; they should not be extrapolated as the current state of affairs. Second, the Tracebit result suggests defense also benefits from AI: if the attacker automates, the defender can plant traps just as fast.

Overall, the lesson about the attack surface is the same as in recent months: every document, email or invitation an agent processes is a new door. The winners are those who design security as part of the user experience (scoped permissions, isolated profiles without saved cards, confirmation before paying). The losers are small brands, whose visual identity can be cloned and slipped into a recommendation before the customer ever reaches their store.

In the short term, it will be an uncomfortable transition: more automated fraud and more friction in every delegated purchase. In the long term, the same technology could enable agents that handle our tedious tasks with verifiable guarantees, and that is what would free up time for what matters. But getting there requires treating human oversight today as the cheapest and most effective control, just as the source itself recommends.