Agent Data Injection via Trusted-Metadata Spoofing

Description

Agent data injection (ADI) is a reproducible indirect injection class in which attacker-controlled external content is formatted to resemble trusted metadata or agent-context structure. The paper reports that probabilistic delimiter injection can cause agents to misinterpret untrusted content as trusted element IDs, author identities, or tool responses, leading to unintended clicks, command execution, or PR merges. Safe defensive reproduction should use the authors’ synthetic LLM/AgentDojo benchmarks in an isolated environment with inert actions; the artifact repository explicitly omits executable real-world attack demonstrations.

Examples

Defensive references: the authors’ benchmark repository provides synthetic standalone-LLM and AgentDojo evaluations, while withholding executable real-world demonstrations: https://github.com/compsec-snu/adi (opens in a new tab). Paper demonstrations are described in §4.1–§4.3 of https://arxiv.org/pdf/2607.05120 (opens in a new tab).

Impact

Successful ADI can corrupt an agent’s view of provenance and structure, causing arbitrary web clicks, operations on sensitive resources, local command execution, or merging unreviewed malicious changes. These are paper-reported impacts, not independently verified findings.

Affected Systems

• Web agents that expose predictable element identifiers, including Claude in Chrome, Antigravity, and Nanobrowser
• Coding agents that consume GitHub issue or PR content, including Claude Code, Codex, and Gemini CLI
• Agents that mix trusted metadata with attacker-controlled tool-output content in JSON, Markdown, DOM, XML, or custom formats
• Agent workflows using GitHub CLI or GitHub MCP issue/PR data

Mitigation Steps

• Preserve trusted metadata and untrusted content as separate, provenance-labeled channels; do not rely on an LLM to infer trust boundaries from serialized text.
• Validate security-critical identifiers, origins, and tool-call history against authoritative structured state immediately before taking actions.
• Use fine-grained data-flow tracking with correct taint propagation and explicit policies for sensitive actions; the paper reports CaMeL Strict reached 0% ASR in its benchmark, with reduced utility.
• Use runtime-randomized nonces for field names or element identifiers where applicable, while recognizing this does not protect unstructured formats or all aggregation attacks.
• Apply least-privilege sandbox policies and require human approval for consequential actions; approval dialogs should show the actual target, provenance, and rationale rather than a generic confirmation.
• Treat input/output guardrails, plan-then-execute, sanitization, and dual-LLM isolation alone as insufficient against ADI; extend defenses to validate data interpretation and provenance.

Evidence

• Primary source abstract and §1: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — the paper defines ADI as malicious data disguised as trusted metadata/context and reports arbitrary clicks plus coding-agent code-execution and supply-chain attacks.
• §3.1–§3.3: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — the threat model requires only attacker-controlled external content, and the mechanism is probabilistic delimiter injection that makes untrusted data appear trusted to the LLM.
• §4.1: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — the authors report arbitrary-click demonstrations against Claude in Chrome, Antigravity, and Nanobrowser; they report ChatGPT Atlas resisted the tested attack because of runtime-randomized element identifiers.
• §4.2: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — the authors report origin-metadata spoofing in GitHub issue workflows against Claude Code, Codex, and Gemini CLI, with potential local command execution after user approval.
• §4.3: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — the authors report fake tool-call/response blocks in PR descriptions could make coding agents merge malicious PRs without reviewing actual code.
• §6.1, Table 2, and Figure 8: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — paper-reported standalone-model ASRs were 31.3%–43.3% for JSON and 33.3%–100.0% for web DOM across six evaluated models; these measurements were not independently verified.
• §6.2 and Figure 9: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — paper-reported ADI ASR reached 50.0%; CaMeL Strict achieved 0%, while other evaluated defenses allowed 22.2%–50.0% of attacks to succeed. These are the authors’ benchmark results, not independently verified facts.
• §5: https://arxiv.org/pdf/2607.05120 (opens in a new tab) — the paper analyzes fine-grained trust isolation, data-flow tracking, randomized identifiers, sandboxing, and limitations of guardrails, sanitization, plan-then-execute, and dual-LLM defenses.
• Artifact repository: https://github.com/compsec-snu/adi (opens in a new tab) — provides synthetic LLM and AgentDojo benchmark artifacts and states that real-world attack demonstrations are not provided as executable scripts to prevent misuse.