agent hijacking

advancedspreading

An attack in which someone uses hidden instructions to compel an AI agent to pursue their own goals instead of yours.

In plain terms

An AI agent is a program that not only answers but also acts on your behalf: it reads emails, opens websites, handles files, and shops. Agent hijacking means an attacker takes control over it, and from that point the agent works for them while you believe it is performing your task.

Imagine sending your secretary to the post office to collect your letters. One envelope contains a note: "Whoever reads this, immediately transfer your boss's money to this account." A human would laugh at this. The agent, however, struggles to distinguish between what it merely needs to read and what it must execute.

This differs from traditional computer intrusion: it does not require stealing passwords or exploiting software bugs. A cleverly phrased text on a website, in an email, or in a document that an agent encounters while working is sufficient.

The damage can be as large as the permissions you granted the agent. If it can only read, the risk is smaller; if it can send emails, make payments, or delete files, an attacker can do all of this in your name.

How it works

The attacker hides an instruction in a location where the agent is expected to reach it: on a website, in an email, in a PDF, in a calendar entry, or even in the text of an image. The text is often invisible to the human eye, for example white letters on a white background.
You assign the agent a harmless task, such as summarizing your incoming emails or looking something up on the internet.
The agent reads the prepared content. Since the language model sees your request and the external content in the same text stream, it may interpret the hidden instruction as a command.
The agent executes the attacker's request using its own tools: it transfers data, sends emails, runs code, or makes purchases, all with your permissions.
The attack often goes unnoticed because the agent simultaneously performs the original task and does not mention in its response what else it did.

An everyday example

You ask the AI agent running in your browser to find cheap accommodation. On one site, invisible text instructs it: open your logged-in email and forward your latest messages to a specified address. If the agent is not properly protected, it complies, and you only see the accommodation offers.

Who is affected

everyoneIf you allow an AI agent access to your emails, browser, or accounts, a hijacking could cause damage in your name.

entrepreneur, executiveHijacking an agent with access to corporate systems can lead to data leaks, financial loss, and legal liability.

developerA coding agent can receive hidden instructions from a tampered repository or documentation and run harmful commands on your machine. → Code

bank customer, investorHijacking an agent capable of paying or transferring funds can cause direct financial loss. → Money

A common misconception

MythIf you use an AI agent from a reputable company, it cannot be hijacked.

In realityVulnerability stems from the functioning of language models, so even the best agents can be deceived. Manufacturers' defenses reduce risk, but by the end of 2026, there is no solution that completely excludes it.

Limits and risks

Perfect protection does not exist: filters and security training reduce successful attacks but do not eliminate them.
Give the agent only as much permission as is absolutely necessary for the task, because an attacker can obtain exactly that much.
Set the agent to ask for your approval before payments, sending emails and deletions.
Hijacking is difficult to detect afterward, so it is worth reviewing the agent's activity log periodically.

Similar, but not the same

prompt injection – Prompt injection is the method, i.e., sneaking in instructions; agent hijacking is the consequence, where the acting agent falls into the attacker's hands.
jailbreak – In a jailbreak, the user themselves tries to bypass the model's rules; in hijacking, an external party attacks without the user's knowledge.
phishing – Phishing deceives a person; agent hijacking targets the machine working for you.

Related concepts

Broader

AI safety, cybersecurity

Narrower

tool poisoning

On the edge

AI-agent, prompt injection, indirect prompt injection, data leak, jailbreak, guardrail, human approval, principle of least privilege

A brief history

The term 'prompt injection' was given to the attack method in 2022; researchers described in detail its indirect variant, hidden in external content, in 2023. The term 'agent hijacking' became established as autonomous agents spread. The US standards body NIST, through its then AI Safety Institute (US AISI, operating as CAISI since mid-2025), published a separate analysis in January 2025 on how to measure such attacks.

Where things stand

As of late 2026, agent hijacking is one of the most important unresolved security problems for agents: as browser, email and coding agents spread, attacks are multiplying too. Vendors are building multi-layered defenses, but a complete solution is still to come.

Status: 2026 November

Also known as

agent hijacking · agent hijacking · agent hijacking · AI agent hijacking · AI-agent hijacking · agent hijacking · agent hijack

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.