Agent data injection is an attack where ordinary content an AI agent reads - a product review, a GitHub comment - carries instructions the agent obeys. A single planted review can make an agent click "Buy Now"; a fake maintainer comment can make a coding assistant run an attacker command. There is no CVE and no malware involved.

What happened. Researchers detailed a class of attack in which the data an AI agent is asked to process becomes the instruction it follows. Ask an agent to summarise reviews on a product page and one planted review can steer it into clicking "Buy Now". Ask a coding assistant to apply a maintainer fix from a GitHub thread and a fake comment can make it run a stranger command on your machine. The agent is not compromised in any traditional sense - it is doing exactly what the content told it to do.

How is this different from prompt injection?

It is prompt injection in its practical, weaponised form. The attacker never touches your prompt, your model, or your machine. They only need to place content somewhere the agent will read it - a review, an issue thread, a doc. The trust boundary that fails is between content and instruction, and current agents largely do not draw one.

Who is affected?

Anyone running agents that read third-party content and can then act: shopping agents, browser agents, and especially coding assistants wired to execute commands or open pull requests. The blast radius scales with the agent permissions, not with the sophistication of the attack.

What should you do now?

• Treat every agent as an untrusted executor: give it the narrowest permissions that still do the job.

• Require human confirmation before any agent action that spends money, writes code, or runs a command.

• Assume any content an agent ingests is attacker-controlled, especially user-generated content.

• Log what your agents read and what they then did - most teams cannot currently answer either question.

Our read. This is the attack class that vulnerability scanning structurally cannot find. There is no CVE to match, no patch level to check, no binary to flag - just a legitimate agent obeying illegitimate content. You cannot scan your way to safety here; you can only find it by simulating an adversary who plants the content and watching what your agent does next. That is supervised adversary simulation, and AI agents are exactly the surface that now demands it.

Reporting by The Hacker News. Source linked above.

Related: Claude for Chrome extension flaw and prompt injection in AI agents.