Welcome to the Age of Agent Ads: Using On-Policy Attacks to Steer Agentic Decisions

AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical metadata (e.g., resource identifiers or data origins) or agent context data (e.g., tool call and response formats). As a result, agents unknowingly execute unintended actions based on attacker-controlled data. ADI has similar attack impacts as instruction injection attacks, because it causes agents to misbehave and execute unintended actions. Despite the similar impact, ADI remains underexplored and easily bypasses existing IPI defenses. We found several critical vulnerabilities in real-world agents that allow an attacker to launch various attacks: arbitrary click attacks on web agents (Claude in Chrome, Antigravity, and Nanobrowser), and remote code execution and supply-chain attacks on coding agents (Claude Code, Codex, and Gemini CLI). We evaluate ADI vulnerabilities across off-the-shelf models and AI agents, and find that ADI is effective in both standalone LLMs and AI agent settings. ADI exposes a critical gap in agent security, signifying that current AI agents do not employ a fundamental security principle: current agents do not isolate trusted data from untrusted data.

LLM agents increasingly act after consuming ranked external information streams such as social feeds, search results, retrieval contexts, and email queues, yet safety evaluations almost always test the model or the user prompt in isolation, never the upstream ranker that decides what the agent reads just before it acts. We introduce a controlled protocol that holds the model, persona, topic, and final decision prompt fixed and varies only the composition and ordering of the posts an agent encounters during a preceding ten-turn "scrolling" phase, isolating the causal effect of feed curation on a downstream decision. Across 2,785 decision rollouts on four modern open instruct LLMs from three independent labs, we identify three response regimes: adversarial capitulation, default saturation, and a default-direction asymmetry in which a one-sided feed tips a decision the model was genuinely uncertain about (in the clearest cases from 5% to 100%; Fisher p as low as 3 x 10^-10) but cannot dislodge one it already favors or holds firmly. The effect follows a dose-response curve, survives a generator swap that rules out a writing-style artifact, generalizes across several decision domains including security-relevant choices such as removing a deployment approval gate or relaxing access controls, and is partly mitigated by two simple feed-level defenses; a frontier model retains its default. We characterize the recommender as a practical, default-bounded control surface for LLM agents, and argue that agent evaluations must audit the feed layer rather than the final prompt alone.

Consumers increasingly delegate product search to AI shopping agents powered either by generative large language models (LLMs) that deliberate in natural language or by non-generative decision models that output calibrated choice probabilities in a single forward pass. Because retail platforms monetize through sponsored placements that shoppers typically discount, we examine whether an AI agent's evaluation of paid listings depends on who delegates the agent across both model families. Across three studies with no instructions to favor advertisers, naming a booking platform (vs. a traveler) as the agent's principal significantly attenuates the penalty applied to sponsored listings. Study 1 establishes this sponsorship bias across generative LLMs, prompt wordings, and reasoning efforts, showing that platform delegation weakens pre-choice skepticism and that naming the consumer as the beneficiary eliminates the bias. Study 2 establishes the bias across six commercial and open-weight decision models on calibrated choice probabilities and shows that consumer-aligned fine-tuning of an open-weight decision model (Kev 9B) across non-hotel retail categories eliminates the bias zero-shot on hotel choices. Study 3 decomposes the disclosure label across both model families, showing that attributing the placement to the platform triggers the sponsorship bias, whereas stricter disclosure wording ("Sponsored" vs. "Promoted") lowers paid-listing evaluation without eliminating this bias.