Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Agent Data Injection Attacks are Realistic Threats to AI Agents

Source

arXiv

arxiv.org/abs/2607.05120v1

Read the source

Source

Plain-Language Brief

A new type of attack called Agent Data Injection (ADI) has been introduced, which injects malicious data disguised as trusted data to make AI agents perform unintended actions. This type of attack can bypass existing security defenses and has been found in real-world agents like Claude in Chrome, Antigravity, Nanobrowser, Claude Code, Codex, and Gemini CLI.

What the Document Says

  • The paper introduces Agent Data Injection Attacks (ADI).
  • ADI injects malicious data disguised as trusted data such as security-critical metadata or agent context data.
  • Agents unknowingly execute unintended actions based on attacker-controlled data.
  • Impact of ADI is similar to instruction injection attacks, causing agents to misbehave and execute unintended actions.
  • ADI easily bypasses existing IPI defenses.
  • Critical vulnerabilities in real-world agents allow an attacker to launch various attacks: arbitrary click attacks on web agents and remote code execution and supply-chain attacks on coding agents.
  • Vulnerabilities are found in Claude in Chrome, Antigravity, Nanobrowser, Claude Code, Codex, and Gemini CLI.

Key Concepts Mentioned

  • Agent Data Injection Attacks (ADI)
  • AI agents
  • Instructions injection
  • Malicious data
  • Trusted data
  • Unintended actions
  • Web agents
  • Coding agents
  • Claude in Chrome
  • Antigravity
  • Nanobrowser
  • Claude Code
  • Codex
  • Gemini CLI

Claims Made by the Document

  • ADI has similar impact as instruction injection attacks.
  • ADI easily bypasses existing IPI defenses.
  • Critical vulnerabilities exist in real-world agents.

Evidence Used

  • Description of ADI and its impacts.
  • Examples of vulnerable agents and the types of attacks they are susceptible to.

Methods / Approach

  • Evaluation of ADI vulnerabilities across off-the-shelf models and AI agents.

Limitations Stated by the Authors

  • Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

  • The paper does not provide detailed information on how to mitigate the identified vulnerabilities.

Open Questions

  • What are potential solutions for ADI vulnerabilities?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • It is important to note that the paper does not focus on providing solutions, but rather on exposing a critical gap in agent security.

Raw Abstract / Excerpt

AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical metadata (e.g., resource identifiers or data origins) or agent context data (e.g., tool call and response formats). As a result, agents unknowingly execute unintended actions based on attacker-controlled data. ADI has similar attack impacts as instruction injection attacks, because it causes agents to misbehave and execute unintended actions. Despite the similar impact, ADI remains underexplored and easily bypasses existing IPI defenses. We found several critical vulnerabilities in real-world agents that allow an attacker to launch various attacks: arbitrary click attacks on web agents (Claude in Chrome, Antigravity, and Nanobrowser), and remote code execution and supply-chain attacks on coding agents (Claude Code, Codex, and Gemini CLI). We evaluate ADI vulnerabilities across off-the-shelf models and AI agents, and find that ADI is effective in both standalone LLMs and AI agent settings. ADI exposes a critical gap in agent security, signifying that current AI agents do not employ a fundamental security principle: current agents do not isolate trusted data from untrusted data.