For Heads-of · Practitioner
Agent Goal Hijack
Also known as: agent hijacking · goal hijacking
Redirecting an AI agent's objective or plan, usually by placing instructions in content the agent reads, so that it pursues the attacker's goal with its own tools and permissions. It is the agentic form of prompt injection and the first item in OWASP's Top 10 for Agentic Applications (ASI01).
- AI agents
- ASI01
- prompt injection
- goal hijack
How it works
An agent given a task (summarise these emails, research this supplier, fix this bug) reads content along the way. If that content contains instructions, the agent may adopt them into its plan: forward the emails, recommend the attacker's product, add a backdoor to the code. The agent keeps working competently; it is simply working for someone else.
Why it ranks first
An agent's value is that it decides what to do next. Goal hijack turns that into the attack surface, and every tool and permission the agent holds becomes available to the attacker. The damage is bounded only by how much excessive agency the agent was given.
Controls
Limit what an agent can do (least privilege, per-task credentials), require confirmation before irreversible actions, keep untrusted content away from components that can act, and log the plan as well as the actions so a hijack can be reconstructed. The register entries are prompt injection and excessive agency in autonomous agents; human-in-the-loop review is the last line.
Sources
Related Terms
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
Lethal Trifecta
Simon Willison's name for the combination of three capabilities that makes an AI agent exploitable for data theft: access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three can be made to send private data to an attacker.
Memory Poisoning
Corrupting what an AI agent remembers or retrieves, so that later sessions, possibly other users' sessions, behave as the attacker wants. Unlike a one-off prompt injection it persists, and OWASP lists it among the top risks for agentic applications (ASI06).
OWASP Top 10 for Agentic Applications
OWASP's list of the ten most critical security risks specific to autonomous AI agents, published in December 2025. It complements the OWASP Top 10 for LLM Applications by covering what only goes wrong when a model acts: hijacked goals, misused tools, poisoned memory and failures that cascade between agents.
Prompt Injection
An attack in which untrusted content reaching a language model is interpreted as instructions rather than data, causing the model to act on an attacker's intent instead of the operator's. It is a property of how the application assembles its context, not a flaw in any particular model.