Prompt Injection Is an SEO Surface Now

A page has always had two audiences: people, and the crawlers that index it for people. A third one arrived this year. Assistants now browse on a user’s behalf, read whatever is on the page, and take actions from it — which means the text on your site is no longer only content, it is input to a system that is deciding what to do next. Anything a stranger can publish on your domain is therefore a channel into somebody else’s agent.

Why your page became an input

The change is in deployment rather than in capability. Anthropic made its Chrome extension generally available on every paid plan on 26 August 2026, with a mode in which the assistant takes actions without approving each one individually. Google documents a fetcher named Google-Agent that “navigates web and performs actions upon user request”, in a user-triggered fetchers page last updated 19 August 2026. That page also states the rule that makes this a site owner’s problem: “Because the fetch was requested by a user, these fetchers generally ignore robots.txt rules.”

So the arrival cannot be prevented at the robots layer, and the agent reading the page cannot reliably distinguish your editorial copy from a comment left ten minutes ago by someone who wanted it to read something specific. The commercial side of that arrival is covered in what happens when AI clicks instead of you; this is the part nobody puts in the pitch.

Where injected text gets in

The surfaces are the ones you already have, and they are all places where the site publishes text it did not write:

• Comments, including on old posts nobody reviews any more.
• Product reviews, especially where a store accepts unverified submissions.
• User profiles and display names, which render in more templates than most site owners realise.
• Forum and community posts, and any support thread rendered publicly.
• Syndicated or imported feeds, where the text passed moderation on somebody else’s site rather than yours.

Hidden text deserves particular attention, because it is the classic vector: content set to display:none, positioned off-screen, or rendered in a colour matching the background is invisible to your moderators and entirely visible to something reading the DOM. A spam filter tuned to catch link drops does not catch a paragraph of instructions with no links in it.

The published numbers, and what they do not cover

The only measured figures available come from Anthropic’s own evaluation, published on 25 August 2025 when it piloted browser control. Across 123 test cases spanning 29 attack scenarios, it reported an attack success rate of 23.6% against the system running autonomously without mitigations, falling to 11.2% with them. On a separate challenge set of four browser-specific attack types, the reported success rate fell from 35.7% to 0%.

Three caveats have to travel with those numbers. They are one vendor’s evaluation of its own product, not independent testing. The sample is small — 123 cases and a four-case challenge set are not a survey of the attack space. And an 11.2% residual on the broader set is a high number for something that runs with your logged-in sessions. Nobody has published comparable figures for the other agentic browsers, so the field-wide rate is unknown, and anyone quoting a general figure for how safe agents are is quoting something that has not been measured.

This is a moderation problem before it is a security problem

The instinct is to look for a new tool. The first line is the controls already installed. Comment moderation set to hold submissions rather than publish on approval, review verification tied to a purchase, profile fields that do not render arbitrary HTML, and a policy for old threads that nobody watches — each of these was already worth having, and each now closes an injection surface as a side effect.

The site-owner changes worth making are narrow and testable. Audit what an unauthenticated fetch of your highest-traffic pages actually returns, because that is what an agent sees and it frequently includes markup the logged-in view hides. Neutralise hidden text in user-generated regions by stripping inline styles and positioning from submitted content rather than sanitising tags alone. Review the moderation defaults on every form that publishes, including the ones inherited from a theme. And keep the ordinary defences current — security headers worth setting do not stop injection, but they limit what an injected script can reach if a submission gets through with markup intact.

The failure mode to watch for is subtler than a hijacked agent. Text placed on your page to be read by a machine also shapes what assistants say about you, which is the mechanism behind why AI assistants cite the wrong source. A review section carrying a competitor’s planted paragraph is a reputation problem long before it is a security incident, and it shows up in neither your rankings nor your logs.