A newly identified attack class, Agent Data Injection (ADI), exposes a fundamental vulnerability in the architecture of modern AI agents. Unlike traditional prompt injection, which attempts to manipulate an LLM through malicious instructions, ADI targets the data layer. By masquerading malicious input as trusted system metadata, ADI bypasses existing security defenses that rely on instruction-data separation.
This research, detailed in arXiv paper 2607.05120, marks the first time this specific vector has been documented. While instruction injection has seen its effectiveness plummet against state-of-the-art defenses—achieving a near-zero attack success rate (ASR) of 0.0% to 0.7%—ADI maintains an ASR of up to 50.0% against those same systems. Current defenses focus on separating instructions from data, but fail to isolate trusted metadata from untrusted user-provided content within the agent’s context.
The core mechanism behind ADI is probabilistic delimiter injection. Attackers insert delimiters specific to the agent’s data format, such as JSON braces, into untrusted fields. This corrupts the LLM’s interpretation of the data structure, causing the model to treat attacker-controlled values as trusted metadata, such as resource identifiers, data origins, or tool call formats. Because the agent cannot distinguish between system-generated metadata and injected data, it executes the malicious payload as if it were a legitimate command.
The researchers demonstrated three distinct attack types across popular agent platforms. In web agents, including Claude in Chrome, Google’s Antigravity, and Nanobrowser, attackers utilized element ID injection to perform arbitrary click attacks. For coding agents like Claude Code, OpenAI’s Codex, and Gemini CLI, the team demonstrated remote code execution via origin injection, where they successfully spoofed GitHub issue comment authors as repository maintainers. Additionally, they executed supply-chain attacks by faking pull request reviews through tool call and response injection.
Across six major models—GPT-5.2, GPT-5-mini, Claude Opus 4.5, Claude Sonnet 4.5, Gemini 3 Pro, and Gemini 3 Flash—the researchers observed JSON-based ASRs ranging from 31.3% to 43.3%. Web DOM-based attacks proved even more effective, with ASRs reaching between 33.3% to 100.0%.
Defensive measures currently struggle to mitigate this threat. The study found that only a technique termed CaMeL Strict, which employs data flow tracking with strict policies, fully prevented ADI. However, this comes at a significant utility cost of 36.5%, making it a difficult trade-off for production environments. Notably, ChatGPT Atlas was found to be immune to these attacks because it utilizes randomized element identifiers, or nonces, rather than the predictable sequential indices that ADI exploits.
The research team, led by scholars from Seoul National University, Largosoft, and the University of Illinois Urbana-Champaign, completed responsible disclosure prior to the paper’s submission on July 6, 2026. OpenAI, Google, and Anthropic have acknowledged the reported vulnerabilities. Nanobrowser has not yet responded to the disclosure. While no CVE identifiers have been assigned to these vulnerabilities, the authors have released their artifacts on GitHub as part of an open science policy.
As agents become more integrated into development workflows and web browsing, the security of the data layer is as critical as the instruction layer. The findings suggest that until agent architectures implement robust isolation between trusted and untrusted data, they will remain susceptible to these structural manipulations.