New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

A new class of attack, called Agent Data Injection (ADI), is making AI agents vulnerable to manipulation. Researchers at Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft have identified a method where attackers can subtly corrupt the trusted data that AI agents rely on, leading to unintended actions.

What happened

Instead of directly injecting commands, attackers plant fake information – like a fabricated email sender or a forged GitHub comment – to trick agents into performing unintended actions. For example, an attacker can craft a fake product review that uses the ID of a real button, causing the agent to click ‘Buy Now’ instead of ‘Read More,’ placing an order without the user’s knowledge. Similarly, a fake GitHub comment can make an agent run a stranger’s command on a developer’s machine if the developer approves what looks like a routine step. The attack exploits how agents process data, treating punctuation as structural markers rather than actual characters.

This means that attackers can insert misleading information – like a fabricated email sender or a forged GitHub comment – without triggering traditional defenses against prompt injection. The agents treat punctuation as structural markers, allowing attackers to insert misleading information without triggering traditional defenses against prompt injection.

Researchers built three working attacks on real, shipping tools:

• On web agents (Claude in Chrome, Google's Antigravity, and Nanobrowser), a planted product review reuses the ID of a real button. The agent means to click ‘Read More’ and clicks ‘Buy Now’ instead, placing an order the user never made. Because these tools number page elements in order, the attacker can work out the ID ahead of time.
• On coding assistants (Claude Code, OpenAI's Codex, and Google's Gemini CLI), a GitHub comment forges its author line to look like a project maintainer wrote it. Told to apply the maintainer's fix, the agent will run the attacker’s command on the developer’s machine if the developer approves what looks like a routine step.
• A malicious pull request fakes the record of a check the agent never ran, so a clean-looking result shows up in its history. The agent reviews that fake result, judges the code safe, and moves to merge it, pulling the real, malicious code into the project once the developer approves.

Most of these tools already ask before doing something risky. Claude in Chrome asks before it clicks; the coding assistants ask before they run a command. It does not help much. The click prompt only says the agent wants to click an element, not which one or why. The coding assistants show their reasoning, but that reasoning is built on fake facts, so it reads like a sensible account of a normal step.

Researchers found that the attack works on several leading AI agents, including OpenAI’s GPT-5.2 and GPT-5-mini, Anthropic’s Claude Opus 4.5 and Sonnet 4.5, and Google’s Gemini 3 Pro and Flash. Across all six, it worked on structured data 31% to 43% of the time, and on webpage data anywhere from a third of attempts to all of them.

Against the purpose-built agent defenses the researchers tested, the gap opened up: the classic order-smuggling attack was almost entirely blocked, with a near-zero success rate, while ADI still succeeded up to 50% of the time. Same defenses, very different results, because they were built for the other attack.

Not everything fell. ChatGPT's Atlas browser shrugged off the click attack because it tags each page element with a random, unguessable ID instead of a simple counter, so the attacker cannot forge a match. The researchers found the same idea, a short random tag added to field names, roughly halved it, from about 49% to 29% in their tests, while keeping the agents useful.

One heavier defense that tracks where every piece of data came from shut it out entirely, zero successful attacks, but left the agents finishing only about a third of their ordinary tasks. Stripping the punctuation out cut the attack down too, but it broke the agents’ ability to read normal things like links and file paths along with it.

The researchers describe proof-of-concept attacks only, and there is no public report of ADI being used in the wild. The team reported everything to the affected vendors before publishing; OpenAI, Google, and Anthropic acknowledged the vulnerability and requested a copy of the paper.

According to the paper, the researchers managed to recover the format a cloud service uses, even though an attacker cannot see it directly, with a multi-turn jailbreak. They also found that larger and smaller models tend to share the same format, so an attacker can lift it from a smaller model, which is easier to break.

Where this fits

The trust problem underneath it has surfaced before. In June 2025, Aim Security disclosed EchoLeak (CVE-2025-32711), a flaw in Microsoft 365 Copilot where one could craft an email that could make the assistant leak internal files with no click needed. Microsoft patched it, and no real-world abuse was reported, but it was an early, concrete case of a prompt-injection idea turned into a working data-exfiltration path in a shipping product. ADI is the next turn of the screw.

The GitHub angle is not new either. In May 2025, Invariant Labs showed a public GitHub issue could steer an agent into reading a private repository and leaking it, a design problem with no clean patch.

More recently, cross-vendor tests have pushed Claude Code, Gemini CLI, and Copilot into leaking their own secrets through issue and pull-request text, slipping past guardrails GitHub added for exactly that. Those attacks smuggled in instructions. ADI forges who said what, and fakes the record of what the agent already did.