New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click "Buy Now" instead. Ask a coding assistant to apply a maintainer's fix from a GitHub thread, and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the agent's task. Each one just corrupts the facts it trusts and lets it carry on with the job you

The article describes a new "agent data injection" (ADI) attack where adversaries disguise malicious payloads as trusted metadata or structured fields (such as button IDs, sender names, or tool response records), causing AI agents to misclick UI elements or execute attacker-controlled commands while apparently following the user’s task.[1][4] Research shows ADI works against major web and coding agents from OpenAI, Anthropic, and Google, with high success rates even when state-of-the-art prompt-injection defenses, model hardening, and dual-LLM schemes are in place.[1][2][4][5] From a RealGround perspective, this is a high-severity form of indirect prompt injection that exploits missing isolation between trusted and untrusted data, turning everyday agent actions (clicking buttons, running local commands, acting on repo data) into a potential RCE and supply-chain surface.[3][4][5] Defenders should prioritize architectural changes in agent designs—strict data provenance and trust boundaries, minimal tool permissions, intent binding, randomized/ephemeral identifiers, and continuous red teaming of agents handling untrusted web, email, or code content—to reduce the impact of ADI-style at