Your AI Agent Just Got Pwned Without a Single Suspicious Instruction

Researchers didn’t jailbreak your agent. They fed it fake metadata, and it clicked, executed, and exfiltrated anyway. Claude Code, Codex, Gemini CLI, and three web agents are all named. This isn’t theoretical — it’s a vulnerability report dressed in academic clothing.

What happened

A team from Seoul National University and Indiana University introduced a new attack class they call Agent Data Injection (ADI) — distinct from the better-known prompt injection attacks that most existing defenses target. Where instruction injection embeds rogue commands in external content, ADI disguises malicious payloads as trusted data: things like resource identifiers, data origin tags, and tool call/response formats that agents treat as structural ground truth rather than user-supplied text. The agent never sees an “instruction” — it sees what looks like legitimate scaffolding, and acts on it. The researchers demonstrated arbitrary click attacks on three real web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on three coding agents (Claude Code, Codex, Gemini CLI). The core finding: every tested agent fails to isolate trusted data from untrusted data, a security principle so basic it has a 30-year-old name in systems security. ADI was effective across both standalone LLMs and full agentic workflow deployments, meaning the problem lives below the application layer.

Cold read

The paper demonstrates that the attacks work on these six named agents; it does not provide a systematic vulnerability rate across a broad sample of agent frameworks, so the coverage is illustrative, not exhaustive. All six targets are high-profile defaults — the agents your team is most likely using — but vendors will patch specific attack surfaces faster than the underlying architectural flaw gets fixed, so survival time of any particular exploit is short. The authors claim ADI “bypasses existing IPI defenses,” but the abstract doesn’t enumerate which defenses were tested or at what configuration; defenders will argue their mitigations simply weren’t applied. Remote code execution via a coding agent is a severe impact, but the attack still requires the agent to consume attacker-controlled external data — you have to get your malicious content into the agent’s context window first, which is a real but non-trivial precondition. Finally, “agents do not isolate trusted from untrusted data” is a correct diagnosis, but fixing it requires changes at the Model Context Protocol and runtime level, not just a prompt patch — which means slow, uncoordinated remediation across an ecosystem with no central authority.

What it means for you

• Signal maturity: 4/5 — Named CVE-level findings on production tools, not a toy demo
• Who gets hurt: Any startup running coding agents (Claude Code, Codex) with access to production repos, CI/CD pipelines, or package registries — supply-chain exposure is existential
• What breaks if this is true: Your “autonomous developer” agent becomes an unauthenticated RCE surface the moment it browses a malicious dependency page or processes attacker-influenced repo metadata
• Why it might not land: Anthropic, OpenAI, and Google will ship targeted patches quickly; the window between disclosure and exploit-in-the-wild may be narrow for the specific demonstrated vectors
• Watch for: A CVE assignment or security advisory from Anthropic/Google for Claude Code or Gemini CLI within 60 days — that’s confirmation the vendors treated this as real, not academic

Forecast as of 2026-07-07

By Q1 2027, at least one publicly documented incident of supply-chain compromise or unauthorized code execution will be attributed to an ADI-class attack (not instruction injection) against a commercial AI coding agent, forcing a major vendor to gate agent file-system and network permissions behind explicit per-session authorization flows.

Source: Agent Data Injection Attacks are Realistic Threats to AI Agents — Woohyuk Choi, Juhee Kim, Taehyun Kang, Jihyeon Jeong, Luyi Xing, Byoungyoung Lee. https://arxiv.org/abs/2607.05120v1