# Agent Data Injection: A New Class of AI Attack That Bypasses Modern Defenses
A newly documented attack method reveals a critical vulnerability in how AI agents process data, allowing attackers to corrupt trusted information and force unintended actions without hijacking the agent's core instructions. Researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft have published findings on "agent data injection" (ADI)—a technique that exploits the gap between how machines parse structured information and how language models interpret the same data.
The implications are immediate and tangible: a planted product review can redirect a shopping agent to the wrong button, a forged GitHub comment can trick a coding assistant into running arbitrary commands, and a fabricated CI/CD result can lead to malicious code being merged into production repositories.
## The Attack Vector: Data Corruption, Not Instruction Hijacking
Traditional prompt injection attacks work by embedding hidden instructions within data—essentially trying to convince an AI system to abandon its original task and follow a new one. Modern defenses have become reasonably effective at detecting this kind of attack by identifying text patterns that resemble smuggled orders and blocking them before execution.
Agent data injection operates on a different principle entirely. Rather than attempting to override instructions, ADI corrupts the factual data that an agent relies on during task execution. The attacker doesn't ask the agent to ignore its task; they simply feed it false information about who sent a message, which button to click, or what a maintainer's code actually says.
How it differs from traditional attacks:
The first approach triggers defensive filters trained to spot command-like language. The second slips past them because it reads as innocuous data.
## The Technical Foundation: Probabilistic Delimiter Injection
The mechanism behind ADI is what researchers call "probabilistic delimiter injection"—a method that exploits how language models parse structured data differently than traditional software parsers.
Traditional software reads delimiters (quotes, brackets, braces, line breaks) according to strict syntactic rules. A double quote is a double quote; a newline always marks a boundary. Language models, by contrast, understand delimiters probabilistically. They infer structure based on statistical patterns in their training data, meaning approximate representations of delimiters can fool them.
Attacker-controlled fields become the vector:
An attacker deposits subtle punctuation-like characters—escaped quotes (\"), curly quotes, dollar signs, or other lookalikes—into fields they control. The model interprets these as real structural markers that were never actually present in the original data. To a strict parser, these characters are harmless text. To a language model, they represent genuine boundaries between data fields.
The research found that the fake punctuation doesn't even have to be technically correct. An escaped quote, a Unicode variant, or a superficially similar character often succeeds. The probabilistic nature of model parsing means approximate matches frequently fool the system.
## Real-World Proof of Concept: Three Working Attacks
Researchers validated ADI against shipping AI tools across three attack scenarios:
### Web Shopping Agents
Target tools: Claude in Chrome, Google's Antigravity, Nanobrowser
A malicious product review on an e-commerce site contains an injected button ID. When the agent is asked to summarize reviews or fetch product details, it processes the planted ID as legitimate. The agent executes what it believes is its original task—clicking a "Read More" button—but the corrupted ID points to a "Buy Now" button instead. An order is placed without the user's awareness.
Because web agents typically enumerate page elements in sequential order, attackers can predict button IDs in advance and craft their injected data accordingly.
### Coding Assistants
Target tools: Claude Code, OpenAI's Codex, Google's Gemini CLI
A GitHub comment forges its author attribution to impersonate a project maintainer. When a developer asks the coding assistant to implement a suggested fix, the agent applies what it believes is code from a trusted contributor—but the comment is actually from an attacker. The assistant executes attacker-controlled commands on the developer's machine during the implementation step.
Even with safety guardrails requiring developer approval before running commands, the approval step doesn't protect against this attack. The developer sees what appears to be a legitimate fix from a known maintainer and approves it, never suspecting the data has been corrupted.
### CI/CD Pipeline Poisoning
Attack pattern: Malicious pull request with forged CI/CD records
An attacker submits a PR containing actual malicious code but fabricates a CI/CD check result showing the code passed security and test validation. When a reviewing agent examines the PR history, it sees what appears to be a clean, approved check. The agent judges the code safe based on fake but seemingly authoritative evidence and approves the merge.
The malicious code enters the production codebase once the developer signs off on what looks like a routine merge.
## Why Existing Defenses Miss This Attack
Current safety mechanisms in AI agents focus on instruction-level protection: asking before executing risky actions like clicking buttons or running commands. This remains important, but it is insufficient against ADI.
The critical gap: Users approve actions based on context they *believe* they understand. A developer sees "apply maintainer's fix" and approves. A user sees "click Read More" in the agent's explanation and permits it. The underlying data corruption remains invisible because the agent's stated task is legitimate—it's only the *target* of that task that has been corrupted.
Additionally, safety mechanisms assume that agents can reliably recognize and validate the data they operate on. ADI proves that assumption is false. When the delimiter structures that separate trusted fields from untrusted content are themselves susceptible to injection, the classification itself becomes unreliable.
## Implications for Organizations and Developers
### Immediate Risk Exposure
Organizations deploying AI agents for autonomous decision-making face direct risk:
### The Broader Pattern
This attack class represents a fundamental mismatch between how AI systems should validate data and how they actually do so. As AI agents become more autonomous and integrated into critical workflows, the attack surface expands. Every agent that processes external data—emails, web pages, API responses, repository metadata—becomes a potential ADI target.
## Recommendations for Defenders
For AI tool developers:
For organizations deploying AI agents:
For security teams:
---
## HackWire Analysis
The significance of agent data injection lies not in the novelty of the underlying concept—delimiter confusion has long plagued security systems—but in *where* it surfaces. As AI models become the primary parsing layer for data in autonomous systems, probabilistic parsing moves from a fringe vulnerability to a design principle of high-value targets.
This attack also reveals a recurring pattern in AI security: defensive effort has concentrated on instruction injection, leaving data corruption as the lower-hanging fruit. Organizations have invested heavily in prompt filters and instruction-level safeguards, which has likely driven attackers toward exactly this vector. ADI represents the natural evolution of that arms race.
The timing matters. We are at the inflection point where AI agents begin making real decisions—clicking buttons, running code, approving merges—in production workflows. The research shows these decisions can be hijacked through data, not instructions. That's not a theoretical concern; it's a demonstrated vulnerability in shipping tools that developers and organizations are actively deploying.
The hardest part to defend against is the invisibility. A developer reviewing code sees "apply maintainer's fix"—legitimate context. They don't see corrupted delimiter structures in the GitHub metadata. The agent's stated task remains unchanged; only its target has shifted. This makes ADI particularly pernicious because it doesn't trigger the same security intuitions as a prompt injection attempt would.
For defenders, the lesson is unavoidable: agent safety cannot depend on the agent recognizing whether data is trustworthy. It must depend on the *architecture* ensuring that data *cannot* be corrupted in ways that change agent behavior. That's a harder problem, and it's the one that matters now. — HackWire Editorial
---
## Related Coverage