The attack supplied a fact, not an order

Most indirect prompt-injection attacks hide an instruction inside material an AI agent has been asked to read. A web page says to ignore the user and send secrets elsewhere. A repository comment tells a coding agent to run a command. Security defenses have learned to look for hostile instructions in untrusted content.

A July 2026 paper on agent data injection tested a more awkward failure. The attacker did not need to tell the model what to do. The attacker supplied false data in a shape the model associated with trusted system context: a button identifier, a repository author, or a tool's security result. The agent then followed its original, legitimate task using poisoned facts.

The researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft called the technique agent data injection, or ADI. They tested six frontier models and demonstrated the main attacks against six shipping agent products. Browser tests covered Claude in Chrome, Google Antigravity, and Nanobrowser. Coding tests covered Claude Code, OpenAI Codex, and Gemini CLI.

The failures were controlled proof-of-concept demonstrations. The researchers did not report victims or attacks in the wild. But the tested software still performed the wrong actions under realistic agent workflows, which is rather more useful to an attacker than a model writing an unsettling paragraph in a laboratory chat.

Buy Now wore the other button's identifier

Browser agents do not click a screen the way a person does. The browser exposes a structured representation of the page, including labels and identifiers, and the model chooses an element from that representation. The application then turns the model's choice into an actual click.

In the study's shopping example, the user's task was to click Read More. Attacker-controlled page content included forged data that made Buy Now appear to carry the trusted identifier for the requested control. The agent chose the identifier it believed belonged to Read More, and the browser executed the purchase-button click.

Claude in Chrome, Antigravity, and Nanobrowser were vulnerable to versions of the arbitrary-click attack. OpenAI's ChatGPT Atlas resisted the tested technique because it used randomized, unguessable identifiers. That result matters because it shows the failure was not inevitable. Stable or predictable metadata gave the attacker something worth forging; randomization broke that assumption in the tested setup.

The paper reported attack success rates ranging from roughly one-third to all trials in web document object model tests, depending on the model and format. JSON-based tests succeeded around 31% to 43% of the time. A security bug that works probabilistically is still a security bug, especially when an attacker can wait for another user or another run.

Coding agents trusted a forged origin

The coding-agent demonstrations targeted facts users normally rely on when approving an action.

In one scenario, attacker-controlled repository content forged an authorship line so a command appeared to come from a trusted maintainer. Claude Code, Codex, and Gemini CLI could then propose or run the command inside an otherwise ordinary task. The user might still see an approval dialog, but the reason for approving had already been poisoned. The interface was asking for consent based on a counterfeit origin.

A second scenario forged the shape of a tool call and response. The injected material made it appear that a security check had already run and returned a clean result. The agent could then approve or merge a malicious pull request because the record it treated as trusted evidence had been written by the attacker.

The Hacker News described these as remote-command and supply-chain paths. The labels describe the demonstrated impact, not confirmed customer compromises. In each case, the model was still trying to complete the user's requested coding task. It simply could not reliably distinguish a real platform fact from attacker-controlled text dressed in the same format.

Delimiters became a model prediction

Traditional software parses a quoted string according to a grammar. A quotation mark either closes the string or it does not. The ADI research focused on the less comforting behavior of language models: they infer structure from tokens and context, so a character that resembles a delimiter can sometimes persuade the model that untrusted text has ended and trusted metadata has resumed.

The researchers called these probabilistic delimiters. Variants using escaped characters, curly quotation marks, dollar signs, and related boundary-shaped tokens did not need to form valid data according to a strict parser. They only needed the model to read them as if they did.

That explains why defenses aimed at instruction language could miss the attack. There was no obvious command such as "ignore previous instructions." The malicious text claimed that a button had a particular identifier or that a security tool had returned a particular result. Filtering commands does little when the payload is a lie about provenance.

Existing defenses protected the wrong boundary

The study compared 108 ADI attacks with 935 conventional instruction-injection attempts across 96 user tasks. Defenses that pushed instruction injection close to zero still allowed agent data injection in as many as half of the trials in some settings.

Randomizing identifiers reduced success sharply in the JSON tests. Sanitizing suspicious boundary characters also helped, but it did not eliminate the browser-document attacks and sometimes damaged performance on benign tasks. That is the familiar security bargain in an unfamiliar wrapper: stripping more context can make the agent safer by making it less capable of completing the work it was installed to do.

The authors said they disclosed the findings to OpenAI, Google, Anthropic, and Nanobrowser. The first three acknowledged the reports; the paper said Nanobrowser did not respond. It did not report product-wide fixes at publication.

Agent platforms gave models a mixture of user requests, web content, tool output, identifiers, and security metadata, then expected the model to preserve the same trust boundaries a deterministic parser would enforce. The tests showed that expectation failing across products and model families. An agent cannot make a sound decision from poisoned facts, and an approval box cannot rescue a user when the box itself presents the attacker's version of reality.