An agent is an AI that doesn't just answer questions — it takes actions. It reads your email, books your calendar, runs searches, calls APIs, fills out forms. It acts on your behalf, using tools, often without you watching each step.

The AI assistant in that Tuesday morning scenario was an agent. It had access to your inbox. It had permission to read things and summarize them. That access is what made it useful — and what made it dangerous.

Every agent has a goal — the task it's supposed to accomplish. "Summarize my inbox." "Book a meeting." "Research this topic." The goal is what you gave it. The goal is why you trusted it with access.

The goal is also what the attacker changed.

To hijack something is to take control of it mid-journey — to redirect it toward a destination the original operator never intended. A hijacked plane still flies. A hijacked agent still works. But it's going somewhere else now, serving someone else's mission.

The attacker didn't break into your account. They didn't stop the agent. They redirected it — while it kept running, looking normal, producing output you expected.