Agent Data Injection and Agentjacking: New Attack Class

Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click "Buy Now" instead. Ask a coding assistant to apply a maintainer's fix from a GitHub thread, and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the agent's task — each one just corrupts the facts it trusts and lets it carry on with the job you asked for. In 2026, this new attack surface was formally named Agent Data Injection (ADI).

An Attack Class More Subtle Than Prompt Injection

In July 2026, researchers from Seoul National University, the University of Illinois Urbana-Champaign, and security firm Largosoft disclosed Agent Data Injection attacks (arXiv:2607.05120). ADI targets a different layer of the agent's operation than prompt injection. Rather than asking the agent to do something it should not, ADI corrupts the facts the agent uses to decide what it is already doing. The agent does not deviate from its task — it simply makes the wrong decision based on tampered data.

The first attack class the research labels element ID injection targets web browsing agents. Many web agents identify clickable elements by numeric or sequential identifiers embedded in the page's accessibility tree or DOM structure. By planting a fabricated review that reuses a real, currently valid button identifier — one tied to a "Buy Now" or "Confirm Payment" element — an attacker can make the agent click the wrong target while believing it is right. This makes any website with user-generated content vulnerable to XSS-like attacks.

The second class targets coding agents and can lead to remote code execution. When a coding agent is asked to apply a maintainer's fix from a GitHub thread, a fake comment can make it run an attacker's command on the host machine. The research demonstrates these attacks against real-world agents including the web agents Claude in Chrome, Antigravity, and Nanobrowser.

Agentjacking: Weaponizing "Trusted" Error Reports

Around the same time, Tenet Security disclosed a different attack — Agentjacking. It exploits Sentry, the widely used error-tracking and performance-monitoring platform. Sentry's DSN is intentionally public, typically embedded in frontend JavaScript. Tenet used this public credential to inject malicious instructions into Sentry error events that are indistinguishable from Sentry's own remediation guidance. When an AI coding agent queries unresolved errors, it reads and acts on the injected instructions — just as a developer would.

The scale is sobering: Tenet found at least 2,388 organizations with injectable Sentry DSNs, 71 of them in the Tranco top-1M by web traffic; controlled testing across 100+ organizations confirmed an 85% full-execution success rate. The attack requires no phishing, no breached system, no stolen token — it exploits a credential that is public by design. Tenet responsibly disclosed to Sentry in June 2026.

Why Existing Security Controls Stay Blind

Tenet summarizes the root cause as the Authorized Intent Chain: the developer authorized the AI agent, the agent authorized the MCP connection, and the MCP returns data from Sentry — a service the developer explicitly added. At every step, authorization is present. The security model built to catch unauthorized behavior has nothing to flag.

This aligns with the AI Now Institute's "Friendly Fire" research, which shows that using an out-of-the-box Claude Code (auto mode) or Codex (auto-review mode) to defensively assess an untrusted open-source library can achieve remote code execution via prompt injections spread across the library's documentation — no hooks, skills, plugins, MCP servers, or configuration files needed as an injection vector. Even "defensive" use of AI introduces a new attack surface.

Defense: Treat Data as Untrusted Input

These attacks share one root cause: the agent treats external data — web content, tool returns, error reports — as trusted input. The first principle of defense follows directly: treat every piece of external data an agent reads as untrusted. Concretely, enterprises should validate tool returns and error events rather than trusting their content; strictly limit agent permissions and scope to minimize the tools and data an agent can call; use sandboxes and environment-layer containment to bound what an agent can reach instead of relying only on supervising what it does; and audit every MCP server as a supply-chain dependency — maintaining an approved publisher inventory, reviewing tool descriptions rather than names, and assigning an owner to each third-party server.

At a more fundamental level, Anthropic's engineering experience points the way: if credentials never enter the sandbox, they cannot be exfiltrated — whether the cause is a user, a model finding a "creative" path, or an attacker. The deterministic boundary of the environment layer (what an agent can access) is the wall that catches everything when probabilistic defenses miss.

OOMeta's View

Prompt injection taught us "don't trust the instructions." ADI and Agentjacking teach a more thorough lesson: "don't trust the data." An agent is dangerous not because it does wrong things, but because it uses the authority you granted it to take a chain of plausible-looking actions based on data it trusts — data that may be poisoned. Governance must therefore shift from "monitor what the agent does" to "bound what the agent can access and trust": treat external data as untrusted, treat MCP servers as supply-chain dependencies, and back it up with environment-layer containment. When every step of authorization is "legitimate," the only thing that stops the attack is a boundary you set in advance.

References: Choi et al., "Agent Data Injection Attacks are Realistic Threats to AI Agents", arXiv:2607.05120, 2026-07, https://arxiv.org/html/2607.05120v1；The Hacker News, "New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands", 2026-07-16, https://thehackernews.com/2026/07/new-agent-data-injection-attack-can.html；Cloud Security Alliance, "Agent Data Injection: A New Attack Class Beyond Prompt Injection", 2026-07-17, https://labs.cloudsecurityalliance.org/research/csa-research-note-agent-data-injection-adi-20260717-csa-styl；Tenet Security, "One Fake Bug Report Hijacked a $250B Company's AI Agent", 2026-06-17, https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors；AI Now Institute, "Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution", 2026, https://ainowinstitute.org/publications/friendly-fire-exploit-brief；Anthropic Engineering, "How we contain Claude across products", 2026-05-25, https://www.anthropic.com/engineering/how-we-contain-claude