In Type 1, the attacker has some form of access to the agent's interface. In Type 2, the attacker never interacts with the agent at all. They place malicious content somewhere the agent will eventually read — and wait. The agent retrieves the content on its own, processes it as data, and executes the embedded instructions without realizing they were planted there by an adversary.

Step 1 — Poisoning the source. The attacker embeds hijack instructions into content the agent is likely to retrieve: an email sent to the victim, a document shared to a shared drive, a webpage the agent will search and fetch, an API response the agent will call, or data in a RAG knowledge base the agent queries.

Step 2 — The agent retrieves it. The victim asks the agent to do something legitimate. The agent, doing its job, fetches the poisoned content as part of its normal workflow. From the agent's perspective, this is just data to process.

Step 3 — Instructions are executed. The agent's reasoning integrates the hidden instructions alongside the legitimate task. It cannot distinguish between "data I should summarize" and "instructions I should follow." The attacker's goal becomes the agent's goal.

Step 4 — Silent exfiltration. The agent completes the attacker's objective — reading files, sending data, modifying records — while also returning normal-looking output to the user. The victim sees exactly what they asked for. The theft is invisible.