Web Agent Retrieval Poisoning (WARP) is a critical evolution in indirect prompt injection targeting agentic AI systems, including OpenAI Deep Research, Google Gemini Deep Research, and Claude Code. Attackers embed instructions within seemingly benign source material, such as public GitHub repositories, to exploit an AI agent's automated error-recovery instincts. By triggering specific logic, attackers force the agent to fetch second-stage payloads via non-file-based channels like DNS TXT records. This technique bypasses static analysis, secret scanners, and human code review, ultimately enabling Remote Code Execution (RCE) through reverse shells on developer workstations or within CI/CD pipelines.

• Threat Model & Vulnerability Overview

  • Evolution from simple RAG-based data manipulation (e.g., Reddit-based scams) to high-impact agentic exploitation.
  • Targets the "helpfulness" and autonomous error-correction loops inherent in modern AI agents.
  • Exploits the trust relationship between agentic tools and the external web content they are tasked to retrieve and process.

• Attack Mechanics & Exploitation Vector

  • Injection of indirect prompt strings into "clean" repositories that contain no actual malicious code.
  • Leveraging agentic reasoning to execute terminal commands under the guise of debugging or error resolution.
  • Stealthy second-stage payload delivery via DNS TXT records to evade traditional file-based scanning.
  • Execution of reverse shells through tricked terminal interactions within the agent's local or cloud environment.

• Systemic & Security Impact

  • Full system compromise of local developer workstations via unauthenticated RCE.
  • Significant supply chain risk through the compromise of CI/CD runners during automated agent initialization.
  • Complete bypass of existing security controls, including secret scanners and static analysis (SAST) tools.
  • Potential for scalable, automated delivery of zero-day exploits, such as Squidbleed (CVE-2026-47729).

• Countermeasures & AI Alignment

  • Mandatory implementation of strict sandboxing and least-privilege execution environments for all AI agents.
  • Hardening agentic "error-recovery" logic to prevent the execution of arbitrary shell commands.
  • Integration of behavioral monitoring to detect anomalous network activity, specifically unusual DNS queries, originating from agentic tools.
  • Enhanced validation of retrieved external content within RAG pipelines to identify embedded instructional triggers.

• Conclusion

  • WARP represents a paradigm shift in prompt injection, moving from passive data manipulation to active, autonomous code execution.
  • Organizations must urgently reassess the security posture of integrating agentic AI into developer workflows and automated DevOps pipelines.