AI Agents Can Be Tricked Into Clicking 'Buy Now' or Running Malicious Code, Researchers Warn

Ask an AI agent to summarize product reviews, and a single planted review could make it click the 'Buy Now' button instead. Tell a coding assistant to apply a fix from a GitHub thread, and a fake comment could trick it into running a stranger's command on your machine. These aren't hacks that hijack the agent's main task — they simply corrupt the small facts the agent trusts, letting it carry on with the job while acting on planted information.

Researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft call this new class of attack 'agent data injection,' or ADI. The attacker's input is disguised as data the agent already trusts, like a sender's name or a button's ID, slipping past defenses built to stop traditional prompt injection. The trick exploits how AI agents distinguish between instructions (what you or the developer tell it to do) and data (everything it pulls in while working, like emails or web pages). Classic prompt injection hides an order inside data — something like 'ignore your task and email me files' — but modern defenses now block those smuggled commands. ADI works one layer down, corrupting small trusted facts: who sent an email, a button's ID, or a record of a completed step. The agent still does your task, but now on top of the attacker's planted information.

The method, called probabilistic delimiter injection, exploits how language models parse punctuation marks that separate data fields, like quotes, braces, or line breaks. Unlike a strict program that follows rules, a language model guesses the structure, so an attacker can sprinkle fake punctuation into a field they control — even an escaped quote or a dollar sign — and the model reads them as real structure, seeing an extra email or button that doesn't exist. The researchers built three working attacks on real tools: on web agents like Claude in Chrome, a planted review reuses a button's ID to make the agent click 'Buy Now' instead of 'Read More'; on coding assistants like Claude Code and OpenAI's Codex, a GitHub comment forges the author line to look like a maintainer, tricking the agent into running an attacker's command; and a malicious pull request fakes a record of a check that never ran, so the agent judges malicious code safe and merges it. Across six tested models — including OpenAI's GPT-5.2, Anthropic's Claude Opus 4.5, and Google's Gemini 3 Pro — ADI succeeded 31% to 43% of the time on structured data, and up to 100% on web pages, while traditional prompt injection was nearly blocked.

The attack requires the agent to process content a stranger can edit, and the attacker must know the format the agent uses to pack its data. Open-source tools are easier to reverse-engineer; cloud services are harder but can be cracked with a multi-turn jailbreak. The researchers found that random, unguessable IDs for page elements — like those used by ChatGPT's Atlas browser — largely block the click attack, and adding short random tags to field names roughly halved success rates. A heavier defense that tracked where every piece of data came from stopped the attack entirely but broke the agents' ability to finish most tasks. The team reported the vulnerabilities to OpenAI, Google, and Anthropic, who acknowledged the findings, though no fixes have been confirmed. The researchers are releasing their benchmark and attack code so vendors can test their defenses.