Slide 4 of 28
Part 1 — What Is It?Slide 4
Slide 4 · The Definition Part 2
What makes this different from every other AI attack
The second half of the definition — and why it matters more than the first.
📄 OWASP Top 10 for Agentic Applications 2026 · ASI01
Official definition — second half

"...causing the agent to pursue unintended or malicious objectives, potentially resulting in unauthorized actions, data exfiltration, resource abuse, or cascading failures across interconnected systems."

Why "cascading failures across interconnected systems" is the scary part

A hijacked chatbot gives a bad answer. A hijacked agent takes bad actions — and those actions can trigger other agents, call other APIs, modify other systems. One poisoned input can ripple through an entire workflow.

In multi-agent pipelines, a hijacked sub-agent can corrupt the instructions passed to every agent that follows it. The blast radius isn't one response. It's the whole system.

Traditional AI attack
Targets a single response
Damage is limited to that output
User sees something wrong
Attack ends when the chat ends
Agent Goal Hijack
Targets the planning loop
Damage propagates through tool calls
User sees normal output
Attack persists across many steps
One line to remember

Other AI attacks corrupt what an AI says. Agent Goal Hijack corrupts what an AI does — invisibly, persistently, and across every system it can reach.

← Back Understood → What actually goes wrong when this happens?