Research
Agent Data Injection Attacks are Realistic Threats to AI Agents
Publication date not yet evaluated · Added · 4 reports arxiv.org
Page published
Coverage timeline
Why it matters
Agent data injection attacks evade the instruction-injection defenses many teams currently rely on, meaning defenders protecting web and coding agents must treat all externally sourced context data — not just apparent instructions — as untrusted.
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data.