A new class of agent data injection attacks can make AI agents mistakenly click buttons or execute attacker commands

The Hacker News introduces Agent Data Injection (ADI) proposed by researchers: attackers manipulate data fields the agent relies on, causing it to act on incorrect information while continuing its original task, rather than directly inserting new operational instructions. The authors demonstrate risks such as erroneous clicks, misidentifying identity, or acting on records in controlled scenarios like web operations and coding assistants, and report that some defenses against traditional prompt injection cannot equally block this kind of data manipulation. Results vary across different products and interface designs; for example, randomizing element identifiers can limit certain click attacks, and stricter data provenance tracking also comes with reduced task completion capability. The report is based on the researchers' experiments and interviews, does not represent confirmed in-the-wild exploitation, and cannot generalize individual defense results into comprehensive security.