Research · curated 13 Jul 2026

Agent Data Injection Attacks are Realistic Threats to AI Agents

Coverage timeline

13 Jul 2026arxiv.orgprimarythehackernews.com 16 Jul 2026thehackernews.com

Why it matters

Agent data injection attacks evade the instruction-injection defenses many teams currently rely on, meaning defenders protecting web and coding agents must treat all externally sourced context data — not just apparent instructions — as untrusted.

A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data.