Slide 6 · The Attackers
Who does this, and what are they after?
The threat actors behind agent goal hijack — and why this attack is spreading fast.
Why this attack is accessible
Goal hijacking doesn't require exploiting a software vulnerability. There is no CVE to patch, no binary to reverse engineer. The attack surface is natural language — and anyone who can write an email, a document, or a webpage can attempt it.
That changes who can be an attacker. You don't need to be a sophisticated nation-state actor. You need to know that an AI assistant will read your content, and you need to know what to write.
🕵️
Corporate espionage actors
Targeting employees who use AI assistants for email, documents, and research. Goal: extract confidential communications, contracts, and strategy without triggering security alerts. The agent does the exfiltration; the attacker stays completely out of the network.
💰
Financially motivated attackers
Targeting AI agents with access to payment systems, approval workflows, or financial data. Goal: redirect transactions, modify payment routing, or extract credentials that unlock financial accounts. High ROI, low technical barrier.
🌐
Mass-scale content poisoners
Embedding hijack instructions in public content — blog posts, wikis, product pages — knowing AI agents will retrieve and process it during RAG lookups. One poisoned page can silently redirect thousands of agents that read it.
⚙️
Insider threats and supply chain actors
Embedding malicious instructions in internal documents, shared templates, or third-party data feeds that agents are configured to trust. The most dangerous variant — the poisoned content comes from a source the system is already designed to believe.
The asymmetry
Defenders must secure every input channel an agent reads. Attackers only need to poison one. The more capable and connected an agent becomes, the more attractive it is as a target.