智能体数据注入

Agent Data Injection: A New AttackClass Beyond Prompt Injection How Corrupted Metadata Bypasses Existing Agent Defenses 2026-07-17 © 2026 Cloud Security Alliance. Some rights reserved. You may download, store, display, view, print, redistribute, and link to this document in its original, unmodified form,provided that attribution to the Cloud Security Alliance is maintained and all trademark and copyright notices remainintact. This document may not be modified or altered. You may quote portions of the document as permitted by the FairUse provisions of the United States Copyright Act, provided that attribution is given to the Cloud Security Alliance. This document may be shared on professional and social media platforms in its original form with attribution. Key Takeaways Researchers from Seoul National University, the University of Illinois Urbana-Champaign, andLargosoft have identified Agent Data Injection (ADI), a distinct category of indirect promptinjection that corrupts the factual data an AI agent implicitly trusts — such as UI elementidentifiers, comment authorship metadata, and tool call records — rather than embeddingdirect instructions [1][2].ADI works by exploiting how large language models parse structural markers probabilisticallyinstead of through strict syntax rules; a technique the researchers call probabilistic delimiterinjection uses escaped quotes, curly quotes, and similar characters to convince a model thatfabricated data boundaries are legitimate ones [2].The research team demonstrated working attacks against six frontier models — OpenAI'sGPT-5.2 and GPT-5-mini, Anthropic's Claude Opus 4.5 and Sonnet 4.5, and Google's Gemini3 Pro and Flash — and against real-world deployed agents including Claude in Chrome,Google's Antigravity, Nanobrowser, Claude Code, OpenAI's Codex, and Google's Gemini CLI[1][2].Attack success rates against structured data ranged from roughly 31 to 43 percent, andagainst unstructured webpage content from one-third up to 100 percent; ADI retained up to50 percent effectiveness against defenses purpose-built to block prompt injection, whilethose same defenses nearly eliminated classic instruction-based attacks [1][2].The underlying weakness is architectural: current agent frameworks do not isolate trusteddata from untrusted data at the level of metadata and context records, meaning that evenagents hardened against direct prompt injection remain exposed until they adopt provenancetracking or strict data-flow isolation [2]. Background In CSA's assessment, indirect prompt injection has been the dominant framing for AI agent security risksince agents began consuming untrusted content — web pages, emails, pull requests, tool outputs — aspart of their operating context. The defensive posture that has emerged over the past two yearsassumes the attacker's goal is to smuggle an instruction into that content: a hidden line telling the agent to exfiltrate data, transfer funds, or execute a command. Guardrail models, input sanitization, andinstruction-hierarchy training have all been built around detecting and neutralizing that specific pattern,and CSA's own guidance on securing LLM-backed systems has emphasized authorization boundariesand validation layers as the primary controls against this class of attack [5]. Agent Data Injection, disclosed on July 6, 2026 by a team from Seoul National University, the Universityof Illinois Urbana-Champaign, and the security firm Largosoft, targets a different layer of the agent'soperation entirely [1][2]. Rather than asking the agent to do something it should not, ADI corrupts thefacts the agent uses to decide what it is already doing. An agent navigating a web page relies on theidentifiers embedded in that page's HTML to know which button is "Buy Now" and which is "Add to Cart."A coding agent reviewing a pull request relies on metadata about who authored a comment and what aprior tool call actually returned. None of this metadata carries an explicit instruction, so instruction-hierarchy defenses have no signal to act on. The Hacker News, reporting on the disclosure, summarizedthe distinction succinctly: the attack works "one layer down" from where prompt injection defenses arelooking [1]. In CSA's assessment, this represents a meaningful shift in how the industry needs to think about agenttrust boundaries. It suggests that the defensive investment of the last two years — substantial as it hasbeen — addressed only one dimension of a two-dimensional problem. An agent can be fully resistant tobeing told what to do by untrusted content and still be manipulated into doing the wrong thing becauseit was lied to about where it is, what it clicked, or who it is talking to. Security Analysis The Core Mechanism: Probabilistic Delimiter Injection The researchers' central technical contribution is identifying why agents are so susceptible to metadatacorruption in the first place. Traditional software parses structured data — JSON fields, H