Agent Data Injection Attacks are Realistic Threats to AI Agents

Abstract

AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection

Categories

Framework mappings

Suggested from the entry's categories.

@misc{choi2026agent,
  title = {{Agent Data Injection Attacks are Realistic Threats to AI Agents}},
  author = {Woohyuk Choi and Juhee Kim and Taehyun Kang and Jihyeon Jeong and Luyi Xing and Byoungyoung Lee},
  year = {2026},
  month = jul,
  eprint = {2607.05120},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05120}
}