Agent Data Injection (ADI) Attack: How AI Agents Can Be Tricked Into Misclicking or Running Attacker Commands

A new class of attack called Agent Data Injection (ADI) has been disclosed by researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft. Unlike traditional prompt injection, which smuggles instructions into data, ADI corrupts the small facts an agent trusts—such as sender names, button IDs, or tool results—causing the agent to carry out its task on manipulated information.

The attack exploits how language models parse structured data. By injecting punctuation-like characters (e.g., escaped quotes, curly quotes, dollar signs) into fields they control, attackers can make the model misinterpret boundaries, creating fake emails, buttons, or tool results. The researchers demonstrated three working attacks on real tools: on web agents (Claude in Chrome, Google’s Antigravity, Nanobrowser), a planted product review can make the agent click “Buy Now” instead of “Read More”; on coding assistants (Claude Code, OpenAI’s Codex, Google’s Gemini CLI), a forged GitHub comment can make the agent run attacker commands; and a malicious pull request can fake a check result, leading to merging malicious code.

All tested models—OpenAI’s GPT-5.2 and GPT-5-mini, Anthropic’s Claude Opus 4.5 and Sonnet 4.5, and Google’s Gemini 3 Pro and Flash—were vulnerable. ADI succeeded 31% to 43% on structured data and up to 100% on webpage data, while classic prompt injection was nearly blocked. The researchers found that random, unguessable IDs for page elements (as used by ChatGPT’s Atlas browser) can mitigate the attack, reducing success from ~49% to ~29%. A heavier defense that tracks data provenance blocked it entirely but reduced task completion to ~33%.

The attack requires the agent to process user-editable content and knowledge of the data format. For cloud services, the format can be recovered via multi-turn jailbreaks. The researchers reported the vulnerabilities to OpenAI, Google, and Anthropic, who acknowledged the reports. No fixes have been shipped or planned as of the paper’s publication. The researchers are releasing their benchmark and attack code for testing.