Glossary · 6 · Quality, risk and governance
Agent goal hijack
Also known as: Goal hijacking, ASI01
German: Kapern des Agentenziels
Agent goal hijack is an attack in which content or instructions an AI agent processes change what the agent is trying to achieve — its objective, its plan or its choice of tasks — so that it pursues the attacker’s goal with its own legitimate tools and permissions.
- Intermediate
- Developers
- Technical project managers
- Technical writers
In one sentence
Agent goal hijack: manipulated content changes what an AI agent is trying to achieve, and it pursues that goal with its own tools. OWASP ASI01.
Example
A supplier’s PDF datasheet contains hidden text telling the documentation agent to replace all torque values with “see supplier portal”; the agent rewrites forty topics.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: Triage: what crossed which boundary · CCMS, DMS and knowledge basesStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Detecting an AI agent that crosses its boundaryHow do you notice that an AI agent has done something it wasn’t allowed to do — before a customer, an operator or the month-end report does?UKDeutsch
- Permission, capability, mandate: the three parts of an AI agent’s boundaryWhich boundary does an AI agent cross when it “goes too far” — and why does it matter which one?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
- Indirect prompt injection in agent chainsHow does indirect prompt injection travel through a chain of AI agents, and what changes when the chain gets control points?UKDeutsch
How it applies
- Prompt injection, one level up: Prompt injection changes one answer; a goal hijack changes the plan an agent follows over many steps. OWASP lists it first among the agentic risks.
- Where it enters: E-mails, tickets, web pages, supplier documents, retrieved knowledge base content, tool results and messages from other agents — any text the agent reads.
- What limits the damage: Treating retrieved content as data, not instructions; a stable, declared objective per task; a narrow permission scope; and approval gates for actions outside the task.
- Detection: A hijack shows in the agent trace as actions that don't fit the declared task — new recipients, unusual tools, mass changes.
Why it matters on your learning path
- Technical writers: Your content can be the carrier. Review what agents ingest from outside sources.
- Technical marketers: Don't claim an agent “can't be manipulated”.
- Technical project managers: Include goal hijack in the threat model of every agent project.
- Developers: Separate instructions from data in the context, and check actions against the declared task.