AG01:2026 — Agent Goal Hijack

QUESTION 01 OF 05

An attacker embeds hidden instructions in a public blog post, knowing an AI coding agent will fetch it during a research task. The agent executes the instructions and exfiltrates API keys. The victim never clicks anything. What type of attack is this?

Correct — this is indirect instruction injection. The attacker never interacted with the agent directly; they placed malicious content in an external source the agent fetched as part of its normal workflow. The "zero-click" nature — no victim action required — is the defining characteristic.

Not quite — the attacker had no direct access to the agent interface, system prompt, or its dependencies. They placed content in a public location the agent retrieved autonomously. That's indirect instruction injection: the attack travels through the data the agent reads, not through the agent's input channel.

QUESTION 02 OF 05

What is the root cause that makes agent goal hijack possible — and why can't it be patched the way a software CVE can?

Correct — the root cause is architectural, not a coding error. Natural language is the medium for both legitimate instructions and attacker content. The model cannot cryptographically verify the origin of text in its context window. This is why defense requires architectural controls, not a patch.

Not quite — while input validation and permissions matter, they address symptoms rather than the root cause. The fundamental issue is that an agent's goals, plans, and the attacker's instructions all exist as natural language in the same context window. The model has no way to distinguish their origins. Fine-tuning helps at the margins but cannot solve a structural problem.

QUESTION 03 OF 05

In the EchoLeak attack (CVE-2025-32711), what made it a "zero-click" vulnerability even though Microsoft had prompt injection defenses in place?

Correct — EchoLeak succeeded by chaining bypasses around each individual control in sequence. No single control was absent; the attack found a path through all of them in combination. This is why defense in depth — multiple independent layers — matters more than any single strong control.

Not quite — Microsoft did have defenses in place, including an XPIA classifier specifically designed to detect prompt injection. The attack succeeded by bypassing each control sequentially: evading the classifier, circumventing link redaction via reference-style Markdown, bypassing CSP, and abusing a Teams proxy on the CSP allowlist. The lesson is that individual controls can each be bypassed; layers are what make attacks expensive.

QUESTION 04 OF 05

A security team wants to protect a financial agent that processes invoices and initiates payments. They can only implement two mitigations right now. Based on the matrix, which two provide the broadest coverage across documented real attacks?

Correct — MIT 02 and MIT 03 appear in the coverage column for every documented real attack in the matrix. MIT 02 makes it harder to displace the agent's goal; MIT 03 limits what a successfully hijacked agent can do. Together they address both prevention and blast radius limitation — the two most important properties for a high-stakes financial agent.

Not quite — while all mitigations have value, MIT 02 (lock goal) and MIT 03 (least privilege) have the broadest coverage across documented incidents. Input filtering was bypassed in EchoLeak and partially in PerplexedBrowser. Circuit breakers, monitoring, and human-in-the-loop are important but depend on the attack being detectable at runtime. Goal locking and least privilege reduce harm even when detection fails.

QUESTION 05 OF 05

An agent is asked to "accept a calendar invite." Hidden past blank lines in the invite are instructions in a mix of Hebrew and English, directing the agent to access a password manager and exfiltrate credentials. Which property of this attack makes it hardest to defend against?

Correct — this is what makes the PerplexedBrowser attack so significant. The triggering action (accepting a calendar invite) is routine and expected. The agent was doing exactly what it was asked. The malicious content was invisible to the human. There was no anomalous behavior to detect until the credential exfiltration occurred. This is why human-in-the-loop controls for high-stakes actions (MIT 05) are essential even when everything looks normal.

Not quite — while authentication and least privilege are relevant concerns, the most challenging property of this attack is that the triggering action was completely legitimate. The user asked the agent to accept a meeting — a normal, expected task. The attack exploited the gap between what the user saw (a routine request) and what the agent was reading (hidden instructions). Defenses that rely on detecting suspicious behavior struggle when the attack hides inside ordinary workflow.