New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

**Executive summary:** Researchers present "agent data injection" (ADI), a class of attacks that forges or injects data treated as trusted metadata by AI agents (e.g., sender names, element IDs, tool results), causing agents to perform unintended actions—such as clicking a "Buy Now" button, running attacker commands on a developer machine, or merging malicious pull requests. The paper demonstrates proof-of-concept attacks across multiple commercial models and tools with substantial success rates, evaluates partial mitigations (randomized IDs, provenance tracking, punctuation stripping), and reports vendor disclosure without evidence of active real-world exploitation.