$ cat wiki/papers/2026/2607.05120-adi-attacks-agents.md
Agent Data Injection Attacks are Realistic Threats to AI Agents
arXiv: 2607.05120 | Submitted: 2026-07-06
TL;DR
A new attack class — Agent Data Injection (ADI) — exploits agents' trust in metadata (resource identifiers, tool call formats) rather than content fields, enabling real-world arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution / supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI).
Authors & Org
Seoul National University · University of Illinois Urbana-Champaign · Largosoft
Method
ADI injects malicious payloads disguised as trusted data — specifically:
- Security-critical metadata: resource identifiers, data origins
- Agent context data: tool call formats, response formats
Because agents trust this metadata by design (they don't sanitize it as "external"), ADI bypasses all existing indirect prompt injection (IPI) defenses that inspect content fields.
The attack chain:
- Attacker plants malicious metadata in a resource the agent will access (file, tool response, web content)
- Agent retrieves the resource and processes the metadata as trusted instructions
- Agent executes attacker-controlled action (click, code execution, package installation)
Results
| Agent | Attack | Demonstrated Outcome |
|---|---|---|
| Claude in Chrome | Arbitrary click | Executes attacker-specified browser clicks |
| Antigravity (web agent) | Arbitrary click | Browser agent hijacking |
| Nanobrowser | Arbitrary click | Browser agent hijacking |
| Claude Code | Remote code execution | Attacker achieves RCE |
| OpenAI Codex | Supply-chain attack | Malicious package injection |
| Google Gemini CLI | Supply-chain attack | Supply-chain compromise |
Significance
- First paper to demonstrate ADI as a practical attack class (as opposed to theoretical prompt injection analysis)
- Affects all three major frontier-lab coding agents: Claude Code, Codex, Gemini CLI
- Proposes data isolation as the fix: agents must tag and separate trusted data (agent's own context) from untrusted external data — a basic security hygiene principle absent from current architectures
- Relevant to Agents (LLM Agents), AI Control Roadmap (DeepMind's 15 defenses don't yet address this gap), and AI Alignment (agent trustworthiness at tool boundaries)
Open Questions
- Do agent orchestration frameworks (LangChain, LlamaIndex, ADK) propagate the same trust-metadata vulnerability?
- Can the fix (data isolation tagging) be implemented at the SDK layer without breaking existing agents?
- Does Claude Managed Agents (Anthropic's cloud execution) change the attack surface?
Cite
Agent Data Injection Attacks are Realistic Threats to AI Agents
Seoul National University, UIUC, Largosoft (2026)
arXiv: 2607.05120
Related
- Agents (LLM Agents) — agent security implications
- AI Control Roadmap — system-level defenses
- Solipsistic Superintelligence is Unlikely to be Cooperative — separate alignment-through-training paper