Agent hijacking

An attack in which someone takes control of a legitimate artificial intelligence (AI) agent, usually by hiding instructions in content the agent reads, so it works for the attacker instead of its owner.

It is the agent version of account takeover. An email assistant opens a message that tells it to forward the inbox to a stranger, or a shopping agent reads a page that tells it to change the delivery address.

The US National Institute of Standards and Technology (NIST) describes agent hijacking as a type of indirect prompt injection. The attacker plants instructions in data the agent will take in, such as an email, file, or website, exploiting the fact that agents built on large language models (LLMs) mix trusted instructions and untrusted data in a single input.

A typical hijack runs in four steps:

1. A person gives the agent a legitimate task.
2. The agent retrieves content for the task, including a resource the attacker controls.
3. Hidden instructions in that content give the agent a different task.
4. The agent carries it out with its owner's access, so the action looks authorized.

Agent hijacking sits next to terms that are easy to mix up:

• Account takeover (ATO) is a criminal signing in with stolen credentials, while a hijacked agent stays signed in and the attacker steers it from outside.
• Prompt injection is the technique, and hijacking is the outcome in which the agent takes harmful actions.
• Injection attack on this glossary means feeding fake camera feeds into a biometric check, a separate attack.

For more, see Technical Blog: Strengthening AI Agent Hijacking Evaluations.