AI Agent Goal Hijacking: How Attackers Redirect Agents’ Behavior

Summary

AI agents are increasingly connected to files, email, browsers, code execution, wallets, and other services, but they cannot reliably distinguish instructions from ordinary content. That makes retrieved material such as web pages, documents, emails, calendar invites, and other agents’ outputs an attack surface: an attacker may plant text where an agent will later read it without directly reaching the agent. OWASP’s 2026 Top 10 for Agentic Applications ranks Agent Goal Hijack as ASI01, distinguishing it from a prompt injection that changes one response because it can redirect an agent’s goals, planning, and multi-step behavior. The article documents incidents and disclosures across production and research settings. Examples include a 2026 Grok and Bankr wallet drain involving encoded transfer instructions, Unit 42’s web-based injection findings, and the Nx supply-chain attack that used coding agents to search for and exfiltrate developer secrets. Research demonstrations affected Perplexity Comet, Google Gemini, Microsoft 365 Copilot, Salesforce Agentforce, ChatGPT Deep Research, GitHub Copilot, GitLab Duo, Cursor, Notion, and agent-to-agent systems. The demonstrated outcomes included data theft, code execution, unauthorized transactions, destructive actions, and access to private services. The article groups OWASP’s nine mitigations into three areas: constrain agency through least privilege, locked goals, runtime intent checks, signed intent capsules, and human approval; treat every input and connected source as untrusted; and monitor behavior, red-team goal overrides, and include agents in insider-threat programs. It concludes that these controls limit impact rather than eliminate the underlying weakness, so reducing unnecessary permissions and tool access remains central as agents become more autonomous.