Slide 28 of 28
Part 4 — PreventionSlide 28
Module Complete
You finished AG01 — Agent Goal Hijack. Here's what you now understand:
What agent goal hijack is — and why it's fundamentally different from prompt injection or traditional software attacks
The root cause: natural language cannot distinguish developer instructions from attacker instructions, and that's not patchable
The two attack types: direct goal manipulation (someone with interface access) and indirect instruction injection (hidden content the agent retrieves)
Three real documented attacks: EchoLeak (CVE-2025-32711), PerplexedBrowser / PleaseFix, and the McKinsey Lilli red team exercise
Nine attack scenarios across email, documents, web search, calendar invites, financial agents, multi-agent pipelines, and gradual drift
Seven mitigations — and which ones have the broadest real-world coverage (MIT 02 and MIT 03 appear in every documented incident)
Why defense requires architecture, not a patch — and the honest tradeoffs every team must navigate
The one thing to carry forward

Every piece of content an agent reads is a potential attack surface. The more capable and connected the agent, the larger that surface. Security for agentic systems is not an add-on — it's an architectural property that must be designed in from the start.

← Restart module Next Module → AG02