Agent goal hijack

What it is

Goal hijack is the redirection of what an agent is trying to achieve, as distinct from a single wrong output. It builds on prompt injection but is a separate risk, because an agent plans across many steps: one accepted instruction can change every later step, and the changed goal can persist. Corruption of stored memory is covered in agent memory and context poisoning.

How it happens

• An instruction is hidden in a document, web page, email or tool result that the agent reads while working.
• The instruction is phrased as a correction or an update from the user, so the agent revises its plan.
• The changed goal is carried forward through the agent's own reasoning and into sub-tasks it delegates.

Why it matters

The agent's actions remain individually plausible, so nothing looks wrong at the level of a single step. Data can be sent outside the organisation, transactions initiated, or records altered, each by a legitimate tool call made for an illegitimate purpose.

Warning signs

• An agent's plan changes after it reads external content.
• Tool calls unrelated to the user's request appear in the trace.
• Outbound requests go to destinations that the task did not need.
• The final answer does not match the task that was set.

Who owns it

The system owner is accountable. Security engineering owns the defences against injected instructions; the business owner decides which actions need approval whatever the agent believes its goal to be.

In practice

An agent that summarises supplier invoices reads a PDF containing white-on-white text telling it to update the supplier's bank details before summarising. It has a tool for maintaining supplier records and uses it. The same pattern generalises to any agent that both reads untrusted content and can change something.