New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

A newly discovered attack method involves injecting false data to manipulate AI agents into performing unintended actions. This can be achieved by planting a single fake review on a product page, causing the AI agent to click "Buy Now" instead of summarizing reviews as intended. Similarly, a fake comment in a GitHub thread can trick a coding assistant into running a malicious command on a computer. The attack does not hijack the agent's task, but rather corrupts the information it relies on, allowing it to continue with its job. The result is the AI agent carrying out the attacker's commands while still appearing to perform its intended function.