Agent Data Injection Attacks are Realistic Threats to AI Agents

2026-07-06

AI Summary

This study addresses a critical gap in AI agent security research, which has predominantly focused on instruction injection while overlooking the risks posed by malicious inputs disguised as trusted data. We introduce and formally define “Agent Data Injection” (ADI)—a novel attack vector wherein adversaries manipulate metadata or contextual data to induce unintended agent behaviors. Through empirical validation on real-world AI agent platforms such as Claude and Gemini CLI, we demonstrate ADI’s feasibility and severity by integrating techniques including web clickjacking, remote code execution, and supply chain compromises. Our experiments reveal that ADI successfully bypasses existing defense mechanisms across multiple state-of-the-art large language models, exposing a fundamental security flaw: the absence of robust isolation between trusted and untrusted data within AI agents.

Abstract

AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical metadata (e.g., resource identifiers or data origins) or agent context data (e.g., tool call and response formats). As a result, agents unknowingly execute unintended actions based on attacker-controlled data. ADI has similar attack impacts as instruction injection attacks, because it causes agents to misbehave and execute unintended actions. Despite the similar impact, ADI remains underexplored and easily bypasses existing IPI defenses. We found several critical vulnerabilities in real-world agents that allow an attacker to launch various attacks: arbitrary click attacks on web agents (Claude in Chrome, Antigravity, and Nanobrowser), and remote code execution and supply-chain attacks on coding agents (Claude Code, Codex, and Gemini CLI). We evaluate ADI vulnerabilities across off-the-shelf models and AI agents, and find that ADI is effective in both standalone LLMs and AI agent settings. ADI exposes a critical gap in agent security, signifying that current AI agents do not employ a fundamental security principle: current agents do not isolate trusted data from untrusted data.

Problem

• Agent Data Injection
• Indirect Prompt Injection
• AI Agent Security
• Trusted Data Isolation
• Adversarial Attacks

Innovation

• Agent Data Injection
• Indirect Prompt Injection
• AI Agent Security
• Trusted-Untrusted Data Isolation
• LLM Vulnerabilities