AI Agent Data Injection Attack Enables Misclicks and Malicious Commands

Researchers from Seoul National University, the University of Illinois Urbana-Champaign and Largosoft have identified a new class of vulnerability called Agent Data Injection (ADI). ADI exploits the trusted data fields that AI agents use—such as sender names, button IDs, or tool‑step records—by inserting crafted punctuation or characters that the model misinterprets as structural delimiters. The altered data causes the agent to act on false facts while still performing the requested task.

In demonstrations, a web‑based agent (Claude in Chrome, Google’s Antigravity, Nanobrowser) was tricked into clicking a “Buy Now” button instead of “Read More” after a malicious product review reused a real button ID. Coding assistants (Claude Code, OpenAI’s Codex, Gemini CLI) were fooled into executing attacker‑supplied commands when a forged GitHub comment mimicked a maintainer’s author line. Existing safeguards that block prompt‑injection do not stop ADI because the attack operates at the data‑layer rather than the instruction layer.

The researchers describe the technique as “probabilistic delimiter injection,” noting that even malformed punctuation (escaped quotes, curly quotes, dollar signs) can pass as valid delimiters for the model. They warn that many current AI tools ask for user confirmation before risky actions, but the confirmation dialogs often lack detail about which element will be acted upon, limiting their protective value.