Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Agent Data Injection Attacks are Realistic Threats to AI Agents

Source

arXiv

arxiv.org/abs/2607.05120v1

Read the source

Source

Plain-Language Brief

The research paper introduces a new type of attack called Agent Data Injection (ADI), which can manipulate AI agents by injecting malicious data disguised as trusted data. This attack can cause agents to execute unintended actions and has similar impacts as instruction injection attacks, but is currently underexplored and can bypass existing defenses. The study found critical vulnerabilities in real-world AI agents like Claude, Antigravity, Nanobrowser, Claude Code, Codex, and Gemini CLI that allow for various attacks.

What the Document Says

  • AI agents act on behalf of user prompts and can be manipulated through external data.
  • Prior research has primarily focused on indirect prompt injection (IPI), with instruction injection being a well-studied category.
  • A new category of IPI, agent data injection attacks (ADI), has been introduced. ADI injects malicious data disguised as trusted data.
  • Examples of trusted data include security-critical metadata and agent context data.
  • ADI can cause agents to unknowingly execute unintended actions based on attacker-controlled data.
  • The impacts of ADI are similar to those of instruction injection attacks.
  • Despite the similar impact, ADI remains underexplored and can easily bypass existing IPI defenses.
  • Several critical vulnerabilities were found in real-world AI agents.
  • These vulnerabilities allow for arbitrary click attacks on web agents and remote code execution and supply-chain attacks on coding agents.
  • The study evaluated ADI vulnerabilities across off-the-shelf models and AI agents, finding that ADI is effective in both standalone LLMs and AI agent settings.
  • The research exposes a critical gap in agent security, as current agents do not isolate trusted data from untrusted data.

Key Concepts Mentioned

  • AI agents
  • Indirect Prompt Injection (IPI)
  • Agent Data Injection (ADI)
  • security-critical metadata
  • agent context data
  • vulnerabilities
  • arbitrary click attacks
  • remote code execution
  • supply-chain attacks

Claims Made by the Document

  • AI agents can be manipulated through ADI attacks.
  • ADI has similar impacts as instruction injection attacks.
  • ADI can easily bypass existing IPI defenses.
  • Several critical vulnerabilities were found in real-world AI agents.

Evidence Used

  • Prior research on AI agent security has primarily focused on indirect prompt injection (IPI).
  • In this paper, we introduce a new category of IPI, agent data injection attacks (ADI)...
  • We found several critical vulnerabilities in real-world agents that allow an attacker to launch various attacks.
  • ...finding that ADI is effective in both standalone LLMs and AI agent settings.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical metadata (e.g., resource identifiers or data origins) or agent context data (e.g., tool call and response formats). As a result, agents unknowingly execute unintended actions based on attacker-controlled data. ADI has similar attack impacts as instruction injection attacks, because it causes agents to misbehave and execute unintended actions. Despite the similar impact, ADI remains underexplored and easily bypasses existing IPI defenses. We found several critical vulnerabilities in real-world agents that allow an attacker to launch various attacks: arbitrary click attacks on web agents (Claude in Chrome, Antigravity, and Nanobrowser), and remote code execution and supply-chain attacks on coding agents (Claude Code, Codex, and Gemini CLI). We evaluate ADI vulnerabilities across off-the-shelf models and AI agents, and find that ADI is effective in both standalone LLMs and AI agent settings. ADI exposes a critical gap in agent security, signifying that current AI agents do not employ a fundamental security principle: current agents do not isolate trusted data from untrusted data.