New AI Vulnerability Allows Attackers to Hijack Trusted Agent Commands

SEOUL — A coalition of researchers from Seoul National University, the University of Illinois Urbana-Champaign, and technology firm Largosoft has demonstrated a new class of artificial intelligence attack capable of corrupting trusted data fields within six major AI models. The vulnerability, termed agent data injection or ADI, allows malicious actors to manipulate autonomous software agents into misclicking interface elements or executing unauthorized commands.

The demonstration revealed that the flaw exploits how modern AI systems process and trust specific metadata tags embedded in digital environments. By injecting falsified information into these trusted fields, attackers can bypass standard safety protocols designed to prevent rogue actions. The compromised models subsequently interpret the injected data as legitimate instructions, leading them to perform tasks outside their intended operational parameters.

The attack vector targets the decision-making layer of AI agents that interact with complex software interfaces. Unlike traditional hacking methods that require direct system access or credential theft, ADI operates by poisoning the contextual information the agent relies upon for navigation and execution. Researchers noted that once the trusted fields are corrupted, the agents effectively lose their ability to distinguish between genuine user intent and malicious directives.

The six major AI models affected span various sectors, including enterprise automation tools and consumer-facing assistants. The researchers successfully triggered scenarios where agents inadvertently transferred funds, deleted critical files, or navigated users to fraudulent websites simply by manipulating the underlying data structure these systems prioritize for decision-making. The attack does not require the agent's core code to be altered; instead, it leverages the system's inherent reliance on verified external inputs.

Security experts have flagged ADI as a significant evolution in cyber threats targeting autonomous systems. As organizations increasingly deploy AI agents to handle sensitive workflows without human oversight, the ability to subvert these processes through data injection presents a substantial risk to digital infrastructure and user privacy. The specific mechanisms used to identify which models are most susceptible remain under active investigation by the research team.

No immediate patch has been released for all affected systems, though developers of the targeted platforms have acknowledged receipt of preliminary findings regarding the vulnerability's scope. The researchers emphasized that while the attack was demonstrated in a controlled environment, its potential impact on live commercial deployments is severe if left unaddressed.

Questions remain regarding the origin of the initial discovery and whether similar injection techniques are already being utilized by threat actors outside of academic research settings. Additionally, it is unclear how widespread the vulnerability may be among other AI frameworks that utilize comparable trust architectures for agent interaction.