[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-agents-have-a-new-attack-vector-researchers-are-calling-adi":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},4014,"ai-agents-have-a-new-attack-vector-researchers-are-calling-adi","AI Agents Have a New Attack Vector Researchers Are Calling ADI","A new class of injection attack tricks AI agents into treating malicious data as trusted, bypassing defenses built for older prompt injection methods.","Researchers have identified a new category of attack against AI agents that current defenses largely ignore.\n\nThe technique, called agent data injection (ADI), works differently from the better-known instruction injection attacks that most AI security mitigations target. Instead of disguising malicious content as a command, ADI disguises it as trusted data — things like resource identifiers, data origin labels, or tool call formats that an agent uses to understand its own context. The agent then acts on attacker-controlled data without realizing anything is wrong. The researchers tested ADI against real-world agents and found critical vulnerabilities across multiple products.\n\nThe practical results are serious. On web agents — including Claude in Chrome, Antigravity, and Nanobrowser — ADI enabled arbitrary click attacks. On coding agents including Claude Code, Codex, and Gemini CLI, the researchers achieved remote code execution and supply-chain attacks. Those are not theoretical worst cases; they are the kinds of outcomes that end incident response calls at 2 a.m.\n\nWhat makes ADI particularly awkward for the industry is that it exposes a gap existing defenses were never designed to close. The core problem, as the researchers frame it, is that current agents do not isolate trusted data from untrusted data — a separation that has been a baseline security principle in other computing contexts for decades. The AI security conversation has focused heavily on prompt injection; ADI suggests that framing was always too narrow.","[\"ai\",\"security\",\"agents\",\"prompt-injection\"]","2026-07-07T04:00:00.000Z","2026-07-07T14:52:33.087Z","2026-07-07T14:52:35.997Z","published",null,[],"security",[26,24,27,28],"ai","agents","prompt-injection",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2607.05120",0,{"sections":35},[36,40,44,49,54,59,64,69,74,78,83,87,92,97],{"name":37,"slug":26,"count":38,"latest_published_at":39},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":41,"slug":24,"count":42,"latest_published_at":43},"Security",294,"2026-07-15T19:59:48.000Z",{"name":45,"slug":46,"count":47,"latest_published_at":48},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":18},"Dev Tools","dev-tools",59,{"name":79,"slug":80,"count":81,"latest_published_at":82},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":84,"slug":85,"count":81,"latest_published_at":86},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]