The attack uses the agent's own capabilities against it. There is no malicious binary to block, no exploit to patch, no signature to detect. The attack is valid text, processed correctly, by a working system. Traditional security tooling — firewalls, AV, WAFs — has no visibility into what an agent is reasoning about.
Because no single control is sufficient, defense requires multiple independent layers — each reducing the probability and impact of a successful hijack. The goal isn't to make hijack impossible. It's to make it detectable, limited in blast radius, and recoverable.
The seven mitigations that follow operate across four dimensions:
Visibility — knowing what the agent is doing and why (MIT 4).
Intent integrity — protecting the agent's goal state from corruption (MIT 1, MIT 2).
Access restriction — limiting what a hijacked agent can reach (MIT 3).
Human oversight — requiring human approval before high-stakes actions execute (MIT 5, MIT 6, MIT 7).
Every mitigation reduces capability alongside risk. Least privilege means the agent can do less. Human-in-the-loop means the agent is slower. Strict input sanitization means some legitimate content gets flagged. There is no free defense. The mitigations that follow are worth it — but teams need to understand what they're trading to deploy them honestly.