Agent Data Injection (ADI)

A new category of indirect prompt injection: malicious payloads disguised as *trusted data* (metadata like a comment's author, a UI element ID, or the tool-call history) rather than as instructions, via probabilistic delimiter injection — the LLM misreads inexact/escaped delimiters as structural boundaries, so the agent does the user's task but on attacker-forged data; working RCE and supply-chain exploits on Claude Code / Codex / Gemini CLI and arbitrary-click on Claude-in-Chrome, bypassing IPI defenses that only separate instructions from data (up to 50% ASR where instruction injection is ~0%)