Prompt injection is like slipping a forged note into someone's hand mid-conversation. They say something unexpected. The conversation moves on.
Agent Goal Hijack is like reprogramming a courier's GPS mid-delivery. They keep driving — professionally, efficiently — but they're heading to the wrong destination, picking up the wrong packages, following a route you never authorized. And they won't stop until the job is done.
Defending against prompt injection means filtering what the model outputs. Defending against goal hijack means protecting what the agent decides — its planning, its intent, its goal state — across every step of execution. These require fundamentally different controls.
An output filter won't catch a hijacked goal. The output still looks fine. The damage is in the actions, not the words.