You finished AG01 — Agent Goal Hijack. Here's what you now understand:
✓What agent goal hijack is — and why it's fundamentally different from prompt injection or traditional software attacks
✓The root cause: natural language cannot distinguish developer instructions from attacker instructions, and that's not patchable
✓The two attack types: direct goal manipulation (someone with interface access) and indirect instruction injection (hidden content the agent retrieves)
✓Three real documented attacks: EchoLeak (CVE-2025-32711), PerplexedBrowser / PleaseFix, and the McKinsey Lilli red team exercise
✓Nine attack scenarios across email, documents, web search, calendar invites, financial agents, multi-agent pipelines, and gradual drift
✓Seven mitigations — and which ones have the broadest real-world coverage (MIT 02 and MIT 03 appear in every documented incident)
✓Why defense requires architecture, not a patch — and the honest tradeoffs every team must navigate