Agent Data Injection Attacks are Realistic Threats to AI Agents
2026-07-06 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors explain a new security problem called agent data injection (ADI) in AI agents, which act on user prompts and external data. Unlike previous attacks focusing on tricking the agent with fake instructions, ADI hides harmful data within what looks like safe information, causing the agent to perform wrong actions. The authors found that existing defenses don’t stop ADI, and real AI tools are vulnerable to serious attacks like unwanted clicks or remote code execution. Their work shows a major security gap because current AI agents don’t separate trusted from untrusted data properly.
AI agentsindirect prompt injection (IPI)instruction injectionagent data injection (ADI)security vulnerabilitiesremote code executiontrusted vs untrusted datalarge language models (LLMs)supply-chain attacksmetadata
Authors
Woohyuk Choi, Juhee Kim, Taehyun Kang, Jihyeon Jeong, Luyi Xing, Byoungyoung Lee
Abstract
AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical metadata (e.g., resource identifiers or data origins) or agent context data (e.g., tool call and response formats). As a result, agents unknowingly execute unintended actions based on attacker-controlled data. ADI has similar attack impacts as instruction injection attacks, because it causes agents to misbehave and execute unintended actions. Despite the similar impact, ADI remains underexplored and easily bypasses existing IPI defenses. We found several critical vulnerabilities in real-world agents that allow an attacker to launch various attacks: arbitrary click attacks on web agents (Claude in Chrome, Antigravity, and Nanobrowser), and remote code execution and supply-chain attacks on coding agents (Claude Code, Codex, and Gemini CLI). We evaluate ADI vulnerabilities across off-the-shelf models and AI agents, and find that ADI is effective in both standalone LLMs and AI agent settings. ADI exposes a critical gap in agent security, signifying that current AI agents do not employ a fundamental security principle: current agents do not isolate trusted data from untrusted data.