Breaking

Researchers Detail 'Agent Data Injection' Attack Affecting Claude Code, Codex, Gemini CLI and Browser Agents

July 16, 2026 at 07:34 EDT

Security
AI Agents

A newly disclosed class of attack against AI agents can make forged data appear trusted, tricking coding assistants and browser agents into wrong clicks or the execution of an attacker's commands—even when the user is prompted to approve the action. In a paper posted to arXiv on July 6, 2026, researchers from Seoul National University and collaborators define and demonstrate what they call Agent Data Injection (ADI), a variant of indirect prompt injection that they argue slips past today's leading defenses.

July 6, 2026 · Seoul National University & collaborators

Agent Data Injection: fooling AI agents by faking the data they trust

A newly disclosed attack class plants forged content — a GitHub comment, a web page, a spoofed tool response — so coding and browser agents mistake it for trusted metadata. It slips past today's leading defenses because those guard the command/data split, not what counts as trustworthy data.

Commercial & open-source agents shown vulnerable

up to 100%

Attack success on web DOM data

up to 50%

Still succeeds even under existing defenses

Why ADI is different: it survives the defenses

Success rate when protected by existing indirect-prompt-injection defenses. Conventional instruction injection is largely neutralized — ADI is not.

up to 50%

Agent Data Injection

0.0–0.7%

Classic instruction injection

Raw attack success by data type

JSON-based injection31.3–43.3%

Web DOM data33.3–100%

Measured across six off-the-shelf LLMs on an extended AgentDojo benchmark.

How the attack flows

Plant forged content

GitHub comment or web page with fake author, tool format, or UI element ID

→

Probabilistic delimiter injection

JSON braces / DOM boundaries blur where trusted context begins

→

Agent trusts the fake

Wrong clicks, merged malicious PRs, remote code execution

Systems shown affected

Coding agents

Claude Code · Codex CLI · Gemini CLI

Web agents

Claude in Chrome · Antigravity · Nanobrowser

Responsibly disclosed to Anthropic, OpenAI, Google, and Nanobrowser ahead of publication. Findings are proof-of-concept, not documented in-the-wild abuse.

The wider ecosystem risk

26.1%

of 42,447 analyzed agent skills carried vulnerabilities — and 5.2% showed signs of malicious intent.

Approval prompts aren't enough

When the underlying data is spoofed, even a user asked to approve an action can be tricked. Defending agents now means authenticating the provenance of data — a far harder problem for tools built to consume open, mutable content.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.