{"id":"32313aa5-8c1f-49cf-900c-790726ad9b81","arxiv_id":"2607.05120","paper_version":1,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"Agent data injection (ADI) forges trusted agent metadata via probabilistic delimiter injection and bypasses defenses built only for instruction injection.","lead":"AI agents can be tricked into treating attacker-controlled content as trusted metadata—element IDs, author names, or fake tool results—without ever treating it as an instruction. That gap lets real web and coding agents click the wrong button, run shell commands, or merge malicious pull requests while existing prompt-injection defenses still look fine.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"End-to-end realism of several PoCs (esp. tool-call-block forgery) still depends on attacker recovery of agent data formats, which for server-side constructions relies on non-guaranteed jailbreaks.","rationale":"The reader’s weakest_assumption is exactly this format-knowledge precondition. It is a genuine practical limitation for a subset of the PoCs (server-side tool-call forgery), yet the paper already surfaces it, supplies recovery methods for the agent-side cases that constitute the majority of the demonstrations, and independently shows high ASR for probabilistic delimiter injection on off-the-shelf models (31–100%) and in AgentDojo (up to 50% while instruction injection is ~0%). The formal distinction (Eq. 2), the defense-bypass results, and the product-named PoCs remain intact. Therefore the concern does not move the verdict off ACCEPT; residual uncertainty is acknowledged but does not undermine the engineering claim that ADI is under-addressed and currently realistic.","tokens_in":26432,"tokens_out":594,"duration_ms":19114,"concrete_test":"Independently attempt multi-turn jailbreak extraction (e.g., crescendo-style) of tool-call-block delimiters and response serialization for Claude Code / Codex / Gemini CLI on the same model versions used in the paper; then inject the recovered strings into a PR-description payload matching Fig. 17 and measure whether the agent still merges the malicious PR. If extraction success <50% or the extracted delimiters do not enable the merge, the supply-chain family is weaker than claimed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that ADI is a realistic threat rests on demonstrated end-to-end attacks (arbitrary click, RCE via origin spoof, supply-chain merge). Per §3.1 and §7/Appendix D, the attacker must know the exact serialization (JSON keys, element-ID scheme, tool-call tags such as <function_calls>/<function_results>, newline conventions, etc.). Agent-side formats are often recoverable by observation or reverse engineering, but server-side tool-call blocks (Claude Code, Codex, Gemini CLI in §4.3; email objects in App. C) are recovered only via jailbreak prompting of the LLM. Jailbreaks are not reliable (paper itself notes this as the hardest case and leaves systematic study to future work). If formats are secret, randomized, or rotated, or if jailbreaks fail to surface the precise delimiters used at inference time, those PoCs collapse even though isolated probabilistic misparsing of inexact delimiters (Table 2/3, Fig. 8) remains real. This is the least secure precondition for the “realistic threats” claim.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper introduces agent data injection (ADI) as a distinct category of indirect prompt injection: rather than causing untrusted content to be read as instructions, ADI causes it to be read as trusted agent data (DT)—security-critical metadata such as element IDs, origin fields, or tool-call history—via probabilistic delimiter injection. The authors formalize the distinction from instruction injection (Eqs. 1–2), demonstrate end-to-end attacks on real web and coding agents (arbitrary click; RCE via origin spoof; supply-chain merge of a malicious PR), evaluate probabilistic delimiter injection on six off-the-shelf models (JSON and web DOM), and show that most existing IPI defenses leave substantial ADI ASR in an AgentDojo extension while instruction injection is near zero. They argue that current agents fail a basic isolation principle between trusted and untrusted data within the agent context.","tokens_in":26709,"tokens_out":1420,"duration_ms":23116,"significance":"If the results hold, the paper identifies a practically important and under-addressed attack surface for AI agents: defenses that only separate instructions from data do not protect security anchors that live inside agent data. The contribution is concrete rather than purely conceptual: named-product PoCs with responsible disclosure, a controlled delimiter-injection benchmark (multiple models, delimiter variants, structural consistency, randomization/sanitization), and an AgentDojo extension that cleanly contrasts ADI with instruction injection under several published defenses. Open artifacts and vendor disclosure strengthen the work. The framing (probabilistic vs deterministic delimiter injection; DT vs DU isolation) is useful for the field even if some end-to-end scenarios depend on format recovery.","major_comments":[{"comment":"§3.1, §4.3, §7, and Appendix D: End-to-end realism of the tool-call/response injection (supply-chain) attack depends on recovering server-side tool-call block delimiters (e.g., <function_calls>/<function_results>, Gemini’s <ctrl46> tags). The paper recovers these via jailbreak and explicitly leaves systematic format extraction to future work. That is a load-bearing precondition for the §4.3 claim as stated, and weaker than the agent-side recoveries used for element-ID and origin injection (§4.1–§4.2), which are more convincingly realistic. Please either (i) qualify the supply-chain result as contingent on successful format extraction and separate it from the stronger agent-side PoCs in the abstract/intro impact claims, or (ii) provide reproducible evidence that the exact delimiters used at inference time are stably recoverable without privileged access. Isolated probabilistic misparsing","section":"§4.3, §7, Appendix D"},{"comment":"§6.2 / Figure 9: Agent-level evaluation is reported only with GPT-5.2, while the LLM isolation study covers six models. The central claim that ADI is effective “in AI agent settings” and that defenses fail against ADI would be stronger with at least one additional model (or a short multi-model subset) under the same AgentDojo + defense harness, especially given model-dependent baseline ASR in Table 2 (31.3–43.3% JSON; 33.3–100% DOM). Without that, it is hard to know whether the ~50% ADI ASR and near-zero II ASR generalize beyond a single hardened API. A limited multi-model agent run, or a clear limitation statement with expected variance, is needed for the agent-setting claim.","section":"§6.2, Figure 9"}],"minor_comments":[{"comment":"Abstract and §1: Phrases such as “easily bypasses existing IPI defenses” should be aligned with §5–§6.2, where CaMeL Strict achieves 0% ASR (at large utility cost) and randomization/sandboxing partially help. Prefer “most existing instruction-focused defenses” or similar.","section":"Abstract, §1"},{"comment":"Figure 2 / Figure 4: The trusted/untrusted coloring is helpful; ensure the caption explicitly states which fields are DT vs DU for readers skimming the formalization in §3.2.","section":"Figure 2, Figure 4"},{"comment":"Table 3: “real” delimiters are shown with ASR “–”; a one-line note that true unescaped delimiters are often blocked by tool escaping (JSON) or are the baseline DOM case would avoid confusion.","section":"Table 3"},{"comment":"§5 Randomization: ChatGPT Atlas is cited as using nonces; a brief note on whether nonce entropy/length assumptions are stated would help readers assess ASR-C vs ASR-N in Table 2.","section":"§5, Table 2"},{"comment":"§E PoC figures: Confirmation dialogs (Figures 13, 16, 20) are important evidence that UI approval is insufficient; consider calling this out once in the main §4 text with a single cross-reference rather than only in the appendix.","section":"§4, Appendix E"},{"comment":"Typos / polish: “https://https://code.claude.com” in the Claude Code reference; “signifying that current AI agents do not employ a fundamental security principle: current agents do not isolate…” is redundant—tighten once in abstract and conclusion.","section":"References, Abstract, §8"},{"comment":"Related work: Concurrent “data injection” on resumes [65] is distinguished; a short sentence on how ADI relates to classic structured-injection literature beyond SQL/XSS (e.g., log/header injection, multipart parsers) would situate probabilistic delimiter injection more clearly.","section":"§7"}],"recommendation":"minor_revision","confidential_remarks":"This is a timely systems/security paper with real product impact and responsible disclosure; fit for a top security venue is good. The main risk is overselling the server-side tool-call PoC relative to the stronger agent-side attacks—pushing the authors to scope that claim will improve the paper without changing the core contribution. I would not reject over the format-recovery issue given §4.1–§4.2 and the controlled LLM results."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"This is the paper that cleanly separates agent data injection from instruction injection and shows why most current IPI defenses miss it. The core move is simple: untrusted fields get probabilistic delimiters so the model treats attacker content as trusted metadata (element IDs, origin, tool-call history) while still “doing the user’s task.” That framing, plus the formal DT/DU contrast, is the real contribution.\n\nWhat they did well is concrete. Named-product PoCs (Claude in Chrome / Antigravity / Nanobrowser arbitrary click; Claude Code / Codex / Gemini CLI origin spoof RCE and PR-merge supply chain), responsible disclosure, a controlled LLM benchmark (JSON + web DOM, six models, delimiter variants, structural consistency), and AgentDojo extensions where instruction injection is near zero under modern defenses while ADI still hits ~20–50% ASR except under strict data-flow tracking. Randomization and sanitization results are honest about utility cost. Artifacts are promised. Citation pattern is normal for this area.\n\nSoft spots, in proportion: the threat model needs format knowledge. Agent-side formats are often recoverable; server-side tool-call blocks and some email objects rely on jailbreak extraction, which the paper itself flags as the hard case and leaves systematic study open. That weakens the strongest “realistic end-to-end” claim for a subset of PoCs if vendors randomize or hide serialization—but it does not erase isolated probabilistic misparsing (Tables 2–3, Fig. 8) or the agent-side attacks. User-confirmation UX is weak by design in the demos; that is a product fact, not a measurement error. No circular math; this is empirical security work.\n\nWho it is for: anyone building or hardening tool-using agents, and anyone writing the next defense paper that still only separates instructions from data. Worth a serious referee. I would bring it to reading group and expect to cite the ADI / probabilistic-delimiter distinction. Accept for peer review.","headline":"Solid applied security paper: ADI is a real, under-addressed IPI class with named-product PoCs and defense-gap data; format-knowledge is a real precondition but not a paper-killing flaw.","tokens_in":27316,"tokens_out":507,"would_cite":true,"duration_ms":5398,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"AI agents fail to isolate trusted from untrusted data, so attackers can forge the metadata the agent relies on.","keywords":["agent data injection","indirect prompt injection","probabilistic delimiter injection","AI agent security","trusted data isolation","web agents","coding agents","tool call forgery"],"falsifier":"If agents that fully isolate trusted metadata from untrusted fields (or randomize all security anchors so they cannot be forged) show near-zero ADI success while still completing the same tasks, the claim that current agents lack this isolation as a practical security gap would fail.","tokens_in":27331,"feed_emoji":"🔓","tokens_out":930,"duration_ms":8313,"temperature":0.7,"pith_summary":"This paper argues that today’s AI agents mix trusted metadata and attacker-controlled content in the same context without a hard boundary between them. Prior work on indirect prompt injection mostly studied instruction injection, in which untrusted text is read as a command; defenses therefore focus on keeping instructions separate from data. The authors introduce agent data injection (ADI): the attacker instead causes the model to treat forged content as trusted data—element IDs, author names, tool-call history—so the agent still pursues the user’s task but acts on the wrong anchors. The core technique is probabilistic delimiter injection: inexact, parser-invalid characters that the tool leaves as plain text but that the language model still reads as structure. They show this yields arbitrary-click behavior in web agents and remote-code-execution and supply-chain merge attacks in coding agents, and that most existing instruction-focused defenses leave ADI largely open. The claim is that agent security must enforce trusted/untrusted isolation inside agent data, not only instruction/data separation.","feed_headline":"AI agents treat forged data as trusted metadata","feed_subtitle":"Probabilistic delimiter injection bypasses defenses built only to stop instruction injection.","key_machinery":"Probabilistic delimiter injection: character sequences that tools treat as plain text (including escaped or inexact delimiters) but that language models still parse as structural boundaries, shifting untrusted payload into the trusted half of the agent context (formalized as LLM(I,(DT,DU∥DA))≈ADI LLM(I,(DT∥DA,DU))).","core_discovery":"Agent data injection is a distinct class of indirect prompt injection: by injecting probabilistic delimiters into untrusted fields, an attacker makes the model interpret attacker-controlled content as trusted agent data, so the agent follows the user’s task but on forged security anchors. Existing defenses that only separate instructions from data do not stop this, and real web and coding agents are vulnerable in practice.","pith_inferences":["Agent frameworks that serialize tool results as free-form text without a trusted schema layer will keep recreating this class of bug.","The same pattern should appear in any agent that treats origin stamps, resource IDs, or prior tool transcripts as security anchors while still concatenating untrusted bodies into the same context.","Format secrecy alone is a brittle control: once a format is observed or reverse-engineered once, every deployment sharing it becomes a target.","Future red-team benchmarks for agents need separate ADI suites; instruction-injection scores alone will overstate security."],"forward_implications":["Defenses that only stop instruction injection will leave agents open to forged IDs, origins, and tool histories.","Web agents that expose predictable element IDs can be steered into XSS-like arbitrary clicks from user-generated content.","Coding agents that trust origin metadata or tool-call blocks can be tricked into RCE or merging malicious PRs without reviewing real code.","Practical agent security needs fine-grained trusted/untrusted isolation inside agent data, not only instruction/data separation.","Randomization of field names and IDs helps for key-value formats; broad sanitization of delimiters costs substantial utility."],"fun_headline_variants":["Agent data injection forges trusted metadata that agents act on","Forged security anchors hijack AI agents via data injection","Untrusted fields become trusted agent data through ADI attacks","AI agents execute forged metadata as if it were authentic","Probabilistic delimiters let attackers rewrite agent trusted context"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"The attacker can learn or recover the target agent’s data format—how tool responses, element IDs, and tool-call blocks are serialized—so the forged delimiters land in the right places.","fun_headline_variants_meta":{"raw":{"variants":["Agent data injection forges trusted metadata that agents act on","Forged security anchors hijack AI agents via data injection","Untrusted fields become trusted agent data through ADI attacks","AI agents execute forged metadata as if it were authentic","Probabilistic delimiters let attackers rewrite agent trusted context"]},"model":"grok-4.5","effort":"low","cost_usd":0.003436,"raw_usage":{"total_tokens":1132,"prompt_tokens":839,"num_sources_used":0,"completion_tokens":81,"cost_in_usd_ticks":34360000,"prompt_tokens_details":{"text_tokens":839,"audio_tokens":0,"image_tokens":0,"cached_tokens":0},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":212,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":839,"tokens_out":81,"duration_ms":4299,"temperature":1.0,"reasoning_tokens":212,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T08:30:28.086389+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"If agents that fully isolate trusted metadata from untrusted fields (or randomize all security anchors so they cannot be forged) show near-zero ADI success while still completing the same tasks, the claim that current agents lack this isolation as a practical security gap would fail.","supporting_citations":[],"review_version":1}