Agent Data Injection (ADI) Attacks Bypassing Instruction-Injection Defenses

Technical Analysis

ADI exploits the fact that agents typically only sanitize or filter data interpreted as natural-language instructions, while trusting structural/contextual fields such as resource identifiers, data origin markers, and tool call/response formatting. By injecting attacker-controlled content into these 'trusted' fields via external data sources the agent consumes (web pages, files, tool outputs), an attacker can manipulate the agent's action-selection logic without ever issuing an explicit instruction-like string. The entry point is any external data ingested during normal agent operation (browsed web content, repository files, tool responses); the attacker gains the ability to trigger unintended UI actions (arbitrary clicks) in web agents or code execution and package installation in coding agents. This crosses the trust boundary between untrusted external data and the agent's internal execution context because agents fail to cryptographically or structurally isolate trusted metadata from attacker-influenced content, effectively giving data-plane input control-plane influence.

Affected Systems

Claude in Chrome, Antigravity, Nanobrowser, Claude Code, Codex, Gemini CLI

Detection Signatures

• Anomalous or attacker-supplied values in fields normally treated as trusted metadata (resource IDs, origin/source tags, tool-call schema fields)
• Tool call arguments or response formats that deviate from expected schema but are still accepted
• Web page or file content containing structured data mimicking internal agent context (e.g., fake tool-response JSON embedded in page DOM or comments)
• Unexpected click/navigation actions on web agents correlated with recently loaded untrusted page content
• Code execution or package install commands triggered shortly after ingesting external repository/file content with no explicit user instruction

Remediation Steps

1. 1

   Enforce trust-boundary isolation

   Architecturally separate untrusted external data from trusted agent context/metadata; never allow externally sourced content to populate fields treated as system-trusted (resource IDs, origins, tool schemas).

2. 2

   Schema and provenance validation

   Cryptographically sign or provenance-tag internal metadata and tool call/response structures so injected look-alike data can be distinguished and rejected.

3. 3

   Least-privilege action gating

   Require explicit user confirmation for high-impact actions (clicks leading to navigation/downloads, code execution, package installs) especially when triggered shortly after processing untrusted external content.

4. 4

   Sandboxing for coding agents

   Run coding agent code execution and package installation in isolated, network-restricted sandboxes to limit RCE and supply-chain blast radius.

5. 5

   Expand red-teaming beyond instruction injection

   Update security testing and IPI defenses to explicitly cover data-field injection (metadata, origins, tool call formats), not just natural-language instruction injection.