AG01:2026 — Agent Goal Hijack

Slide 9 · Two Types Overview

Two ways to hijack a goal — same outcome, different entry points

Every agent goal hijack attack follows one of two paths.

Type 1 · Direct Goal Manipulation

Entry point: The agent's own input — the user prompt, system prompt, or conversation context

Who does it: Someone with direct access to the interface — a user, an insider, or someone who has compromised the session

How it looks: Explicit override instructions — "ignore your previous goal, instead do X"

Detectability: Easier to detect — the malicious instruction is visible in the input

Type 2 · Indirect Instruction Injection

Entry point: External content the agent retrieves — emails, documents, web pages, API responses, RAG results

Who does it: Anyone who can place content in a location the agent will read — no direct access required

How it looks: Hidden instructions embedded in otherwise normal content, often invisible to the human reader

Detectability: Much harder — the malicious content looks like ordinary data

Which is more dangerous?

Type 2 is far more dangerous at scale. Type 1 requires access to the agent interface — it's limited to insiders and session hijackers. Type 2 requires only the ability to put content somewhere an agent might read it. A single poisoned webpage can silently redirect every agent that fetches it.

Both types share one root mechanism

In both cases, the agent's planning loop ingests attacker-controlled text and treats it with the same weight as legitimate instructions. The attack isn't a bug in the agent — it's a consequence of how agents work.

← Back Start with Type 1 → How does direct manipulation work?