Agent Data Injection: fake delimiters in trusted data fields beat dedicated prompt-injection defenses 50% of the time — lineage tracking is the only thing that stopped it
arXiv 2607.05120 (Seoul National University, UIUC, Largosoft) introduces probabilistic delimiter injection: attackers plant escaped quotes, curly quotes, and dollar signs inside fields the agent already trusts (sender names, button IDs), and the model parses them as real structure where a strict parser would not. Success was 31–43% on structured data, 33–100% on webpage data, and up to 50% against defenses purpose-built for prompt injection — versus near-zero for classic injection — across GPT-5.2, GPT-5-mini, Claude Opus 4.5, Sonnet 4.5, Gemini 3 Pro and Flash. Two defenses that actually work: assign unguessable random IDs to page elements (drops success ~49% → ~29%), and full data-source lineage verification, which eliminated every tested attack.
↳ Follow the thread