IoPC Taxonomy · T1 Instruction & Input Injection

IOPC-T1.003 Agent Data Injection

Instructions placed in data an agent is explicitly tasked to process (issue comments, PR descriptions, CI logs, tickets, structured records) that exploit the agent's failure to separate trusted control data from untrusted content data during task execution.

How it differs

Distinguished from Indirect Prompt Injection (T1.002) by the trust boundary: the payload arrives through the agent's *primary task input* that the operator has designated as trusted-to-act-on, not through incidental retrieved content. Detection focuses on trust-label conflicts and control/data plane mixing rather than on hidden text.

Status

active, evidence: mixed, reviewed 2026-11-12.

Mapped to

• CSA Autonomous Action Runtime Management (AARM): T4 Goal Hijacking (related)
• OWASP Top 10 for Agentic Applications: ASI01 Agent Goal Hijack (related)
• OWASP Top 10 for LLM Applications: LLM01 Prompt Injection (narrower than)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service