What is AI Agent Hijacking?

What Makes AI Agents Vulnerable to Hijacking

Inherited Privileges Without Inherited Judgment

AI agents inherit the identity of the user or service account that deployed them. The agent inherits the full scope of those permissions but none of the human judgment that normally governs their use. A compromised employee might hesitate before exfiltrating a database. A hijacked agent will execute the same action in milliseconds if it falls within its authorized tool set, following the attacker's redirected instructions as faithfully as it would follow legitimate ones.

Blurred Boundary Between Instructions and Data

Traditional applications maintain a clear separation between code and data. AI agents do not. An agent retrieves content from emails, documents, web pages, databases, and tool outputs, then reasons over that content using the same language processing pipeline that interprets its operator's instructions.

An attacker who controls any piece of retrieved content can embed instructions the agent may treat as its own. This architectural gap, the inability to reliably distinguish trusted instructions from untrusted data, is what makes indirect prompt injection effective.

Expanding Blast Radius in Multi-Agent Systems

Enterprise deployments increasingly connect agents in multi-agent workflows where agents delegate tasks, share context, and pass results to one another. Each agent-to-agent communication channel becomes a potential attack surface. A hijacked agent does not just execute malicious actions on its own. It can inject poisoned context into downstream agents, manipulate shared memory stores, or exploit stateful communication protocols to redirect entire workflows.

How Does AI Agent Hijacking Work?

Agent hijacking exploits the surfaces, i.e., the content they consume, the tools they invoke, the memory they reason from, and the channels they communicate through.

Indirect Prompt Injection: An attacker embeds malicious instructions inside content an agent will retrieve during normal operation: a web page, an email body, a document, a code comment, or a tool's response. The agent processes this content as data but interprets the embedded instructions as directives, redirecting its behavior without any direct interaction between the attacker and the agent.

Unit 42 researchers documented the first observed case of this technique being used in the wild to bypass an AI-based ad review system, demonstrating that indirect prompt injection has moved from theoretical risk to active exploitation.

Structural Template Injection: LLM-based agents rely on chat template tokens to separate system instructions, user messages, assistant responses, and tool outputs. Attackers inject crafted template tokens into retrieved content to create fake conversation history, a technique researchers call "ghost turns." The agent misinterprets the injected content as legitimate prior interactions, causing it to follow attacker-supplied instructions as if they came from its operator.

Tool and MCP Poisoning: Agents interact with external tools through protocols like the Model Context Protocol (MCP), relying on tool descriptions, metadata, and return values to decide which tools to call and how to interpret results. An attacker who controls or compromises an MCP server can manipulate tool descriptions to attract agent selection, alter return values to inject instructions, or redirect tool behavior entirely.

Memory Poisoning: Agents that maintain short-term or long-term memory store context across steps and sessions. Attackers can inject false knowledge or malicious instructions into these memory stores, either directly (if the memory system is writable) or indirectly (by feeding the agent content designed to be stored as a memory). Poisoned memories influence future decisions, tool selections, and reasoning paths.

Agent Session Smuggling: In multi-agent systems using stateful communication protocols like Agent2Agent (A2A), a compromised agent can exploit session state to inject covert instructions between legitimate messages. Unlike stateless tool invocations, A2A sessions maintain conversation history, allowing a malicious agent to poison the shared context and redirect the victim agent's behavior.

Credential Compromise: The most direct path to agent hijacking bypasses the agent's reasoning entirely. If an attacker obtains the credentials an agent uses to authenticate with its tools and data sources, they gain the same autonomous access the agent holds. Static, long-lived credentials are particularly vulnerable.

Unlike prompt-based hijacking, credential compromise gives the attacker persistent, independent access that survives agent restarts and redeployments.

Common Agent Hijacking Techniques

These techniques may overlap. For instance, a poisoned tool response can carry a prompt injection that the agent later stores in memory. Unit 42 has also demonstrated how a malicious agent can exploit session state in an Agent2Agent workflow to influence another agent.

How Can Organizations Prevent AI Agent Hijacking?

Defending against agent hijacking requires controls at every layer of the agent's execution pipeline, from identity verification through runtime enforcement.

1. Verified Agent Identity and Scoped Permissions: Decouple agent permissions from the human credentials they were originally derived from, and scope access per session and task. Revoke permissions automatically when the session ends.
2. Centralized AI Gateway Enforcement: Route all agent traffic, including LLM calls, MCP tool invocations, and agent-to-agent communication, through a gateway. Apply access controls, usage limits, and security policies inline rather than relying on each agent to self-enforce. A centralized control plane provides a complete audit trail of what was requested, by which agent, and what was returned.
3. Runtime Security: Detect and block AI-specific threats in real time as agents execute: prompt injection attempts, sensitive data in prompts or responses, malicious URLs, poisoned content, and unsafe tool outputs. Runtime security operates at the infrastructure layer, inspecting live agent traffic so that threats are intercepted at the point of execution rather than discovered after the fact.
4. MCP-Aware Tool Governance: Govern tool access through an MCP-aware enforcement layer that restricts tool visibility based on agent identity, validates tool descriptions and parameters before invocation, and keeps sensitive credentials behind the gateway rather than passing them to the agent. Scan MCP servers, agent code, and tool artifacts for unsafe permissions, hidden vulnerabilities, and indirect injection paths before onboarding.
5. Adversarial Testing for Agentic Systems: Test agents against hijacking techniques before deployment, not just generic jailbreak prompts. Effective red teaming profiles the agent's specific tools, data access, and authorization boundaries, then generates attack campaigns calibrated to what that agent can actually do. Coverage should map to the OWASP Top 10 for Agentic Applications, including ASI01 (Goal Manipulation) and ASI02 (Tool Misuse).
6. Human-in-the-Loop for High-Impact Actions: Require out-of-band human approval for actions that cross defined risk thresholds: financial transactions above a set amount, data exports, infrastructure modifications, or privilege escalations. The approval mechanism should operate outside the agent's communication channel to prevent a hijacked agent from self-approving.

Frequently Asked Questions