New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands
Summary: Researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft posted a paper on July 6 describing agent data injection (ADI), an attack that corrupts the small facts an agent trusts - a sender's name, a button's ID, a tool result - so the agent completes the user's task on top of planted information. In testing against GPT-5.2, GPT-5-mini, Claude Opus 4.5, Sonnet 4.5, Gemini 3 Pro and Flash, ADI succeeded on structured data 31% to 43% of the time and on webpage data from a third of attempts to all of them, while purpose-built agent defenses that nearly eliminated classic instruction injection still let ADI through up to 50% of the time.
Why it matters: The approval prompts users rely on - Claude in Chrome asking before a click, coding assistants asking before a command - show that the agent wants to act but not which element or why, so a user cannot tell a real approval from a manufactured one. OpenAI, Google and Anthropic confirmed the attack is valid, and the researchers said they have not been informed of any fix, shipped or planned.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026