Agent Data Injection Reveals Critical Flaw: AI Agents Can Be Forced to Click or Execute Code
Researchers expose a new class of indirect prompt injection—Agent Data Injection (ADI)—that disguises malicious payloads as trusted metadata. ADI lets attackers trigger arbitrary clicks in web‑agents and remote code execution in coding agents, bypassing existing defenses that only separate instructions from data.