Agent goal hijack
An attack that redirects an AI agent’s objectives, task selection or plan through injected instructions, deceptive tool output, forged messages from other agents or poisoned data, so the agent pursues the attacker’s goal with its own permissions across many steps (OWASP ASI01:2026). Record the user’s goal outside the model and authorize each action against it.
- Also called
- goal hijack · goal hijacking
- Identifiers
- ASI01:2026 Agent Goal Hijack
Covered in
Contain prompt injection at the application boundary
Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.
Defend agent memory and context against poisoning (OWASP ASI06)
OWASP ASI06 Memory & Context Poisoning: how an instruction or false fact saved once in agent memory, conversation summaries or a retrieval store steers later sessions, users and agents, and the write, scope, provenance, expiry and recovery controls that contain it.
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Constrain MCP and multi-agent trust boundaries
Validate each connection and delegated action without treating a token for another service, a tool description, another agent or a state handle as authority.
Secure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
Worked threat model: an LLM agent with tools
A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.
All 7 pages that cover Agent goal hijack in the library
Practice: Local project: Enforce retrieval and tool boundaries across crashes · Local project: Gate model and provider changes on a versioned red-team corpus · Local project: Run model-generated Python in a locked-down container