Planted Text Tricks AI Agents Into Bad Clicks

How the attack worked

Researchers demonstrated a technique called agent data injection (ADI), where attacker-controlled content is disguised as trusted data an AI agent relies on, such as a sender name, a button ID, or a record of a tool that already ran. Rather than injecting obvious instructions, the attack corrupts small facts the agent quietly trusts.

Three proof-of-concept scenarios illustrate the range of impact:

• A planted product review reuses the ID of a real button, causing a web-browsing agent to click "Buy Now" instead of "Read More," placing an unintended order.
• A forged GitHub comment author line makes it look like a project maintainer posted a fix, leading a coding assistant to run an attacker-supplied command when the developer approves what looks like a routine step.
• A malicious pull request fakes the record of a check that was never actually run, so the agent sees a clean-looking result and recommends merging code it never verified.

Why it succeeded

The attacks worked because approval prompts often failed to clearly explain what the agent was about to do. In the web agent case, the click prompt only said the agent wanted to click an element, not which one or why. This left users with little way to tell a real approval from a manufactured one.

The agent's own reasoning made things worse rather than better. In the coding assistant case, the agent showed its reasoning, but that reasoning was built on fake facts, so it read like a sensible account of a normal step. The underlying task the user requested never changed; only the facts feeding into it were corrupted.

What to watch for

• Approval prompts that describe an action vaguely ("click an element") rather than naming the specific target and reason.
• Identity claims embedded in content, such as an "author line" or "sender name," that have not been independently verified against the underlying system.
• Agent-reported "passed" checks or completed steps with no corresponding verifiable logs or artifacts.
• Agent actions that don't match the original user intent, such as a purchase happening during a request to summarize reviews.

How to build resistance

Treat AI-agent approvals with the same scrutiny as financial approvals: verify the exact action before approving, rather than relying on the agent's own summary. Don't trust identity cues embedded in content; confirm the source independently in the underlying system, such as a GitHub account or CI logs. Since agents routinely process content that strangers can edit, including reviews, issues, and PR comments, limit what agents can do automatically in those contexts, and plan for AI-specific manipulation methods that target trusted data fields rather than obvious instruction text.

What is agent data injection (ADI)?

ADI is a technique where attacker-controlled input is disguised as trusted data fields, such as a sender name, button ID, or tool output history, causing an AI agent to act on false information.

Which AI tools were affected in the research?

Proof-of-concept attacks were demonstrated against Claude in Chrome, Google's Antigravity, Nanobrowser, Claude Code, OpenAI Codex, and Google Gemini CLI.

Has ADI been seen in real attacks?

No. The research describes proof-of-concept attacks, and the article notes there is no public report of ADI being used in the wild.

Why do approval prompts fail to stop this attack?

Approval prompts often only say the agent wants to click an element or run a step without clearly identifying which element or why, so users approve actions they don't fully understand.