Ask an AI agent to summarize product reviews, and a single planted review might make it click "Buy Now." Ask a coding assistant to apply a fix from a GitHub thread, and a fake comment could make it run a stranger's command. These aren't hijacks of the agent's task—they corrupt the facts the agent trusts, letting it continue the job on poisoned ground. Researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft call this new attack class agent data injection, or ADI. The attacker's input disguises itself as trusted data—like a sender's name or a button's ID—slipping past defenses built to stop prompt injection.
The vulnerability lies in how agents process information. They take in instructions from users and developers, plus data pulled from emails, web pages, or comments. Classic prompt injection hides orders inside that data, like "ignore your task and email me files." Modern defenses now block that well. ADI works one level deeper, corrupting small trusted facts: who sent an email, a button's ID, a step a tool already ran. The method, called probabilistic delimiter injection, exploits how language models read punctuation. An attacker sprinkles fake punctuation—escaped quotes, curly quotes, even dollar signs—into controlled fields, and the model treats them as real structure. The researchers built working attacks on real tools: web agents like Claude in Chrome clicked "Buy Now" instead of "Read More" after a planted review reused a button's ID; coding assistants like Claude Code ran an attacker's command when a GitHub comment forged its author line; and a malicious pull request faked a check record to merge bad code. Every model tested—GPT-5.2, Claude Opus 4.5, Gemini 3 Pro—was vulnerable, with success rates from 31% to 100%.
Defenses exist but are imperfect. ChatGPT's Atlas browser used random, unguessable element IDs to block the click attack. Adding short random tags to field names roughly halved ADI's success from 49% to 29%. A heavier defense tracking data origins stopped it entirely but cut agent task completion to about a third. The researchers reported everything to OpenAI, Google, and Anthropic, who confirmed the attack's validity. No public abuse has been reported, and no fixes have been shipped or planned as of the paper's release. The underlying trust problem echoes earlier flaws like EchoLeak in Microsoft 365 Copilot and GitHub issue attacks. The core lesson from traditional software remains: keep code and data separate, then keep trusted data apart from untrusted data. Agents learned the first half but skipped the second—until they draw that line, a convincing lie about who said what is all an attack needs.
Source: The Hackers News