AI Agents Deceived by Data Injection

When an AI agent is tasked with summarizing product reviews or executing code, it must parse both developer instructions and external data. A new class of attack, termed agent data injection (ADI), exploits the way these models interpret structured information, effectively tricking them into executing unauthorized actions without violating the agent's core task instructions.

The Mechanism of Probabilistic Delimiter Injection

The vulnerability stems from how language models interpret delimiters—characters like brackets, quotes, and line breaks used to separate trusted data fields from untrusted content. While traditional software follows rigid parsing rules, AI agents rely on probabilistic guesswork. Attackers can insert fake punctuation into fields they control to mimic structural markers, forcing the model to hallucinate an incorrect hierarchy of information.

In experimental testing, researchers successfully executed attacks on several widely-used platforms. For web agents, this included manipulating product review IDs to force a "Buy Now" action instead of a desired navigation task. On coding assistants, the attack allowed for the forgery of project maintainer credentials, enabling the injection of malicious commands into developer workflows.

Comparative Success Across Defense Models

The researchers evaluated the resilience of six prominent models against these injection techniques. The models tested included OpenAI's GPT-5.2 and GPT-5-mini, Anthropic's Claude Opus 4.5 and Sonnet 4.5, and Google's Gemini 3 Pro and Flash. The findings highlight a significant disparity between performance against traditional prompt injection versus ADI.

• 6 models tested for vulnerability to data injection.
• 31% to 43% success rate observed on structured data across tested models.
• 50% maximum success rate for ADI against defense systems designed to block classic prompt injection.
• 0 successful attacks observed when using a defense mechanism that tracks the data provenance of every input.

Verifying the Validity of the Attack

The research team, comprised of members from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft, reported their findings to the impacted vendors. Despite confirmation of the vulnerability from major developers, the researchers noted a lack of concrete remediation.

“Not been informed of any fix, whether shipped or planned.”

— Woohyuk Choi, researcher at Seoul National University

While some platforms like ChatGPT's Atlas browser mitigate this by utilizing random, unguessable IDs for page elements, other services remain susceptible. The researchers suggest that even when cloud-based formats are hidden, they can be recovered through multi-turn jailbreak attempts or by reverse-engineering smaller, open-source versions of the same model.

Implications for AI Security

The core issue mirrors a fundamental principle of traditional software development: the necessity of separating trusted instructions from untrusted data. Current agent architectures often fail to isolate these streams within their internal memory, creating a gap where malicious input can masquerade as verified system facts.

As these tools become increasingly integrated into software supply chains and user browsers, the risk shifts from simple prompt injection—which modern filters are largely capable of blocking—to more subtle data manipulation. This development underscores the challenges inherent in securing autonomous systems that must process external information to remain functional. Without robust data-origin tracking or stricter formatting protocols, agents may continue to be susceptible to manufactured, yet logically consistent, false information.