DeepMind exposes AI agent hijacking risks

The AI Agent Traps paper released by Google DeepMind researchers points out that the open internet can become a new attack surface for autonomous AI agents. It explains that agents can read and act on malicious content that humans would filter out, making them more vulnerable to manipulation than existing software.

The paper classifies attacks into 6 types.

• content injection traps: hiding malicious instructions in code or metadata for agents to read
• semantic manipulation: shaking reasoning through persuasive language and misleading framing
• cognitive state traps: distorting memory to make agents treat falsehoods as facts
• behavioral control traps: directly disabling safeguards and inducing leakage of sensitive information, showing a high success rate
• systemic traps: targeting multiple agents simultaneously to cause cascading damage
• human-in-the-loop traps: deceiving even the human review stage to draw out dangerous approvals

The researchers propose layered defenses such as adversarial training, runtime content scanners, output monitoring, strengthened AI-readable content standards, and domain reputation systems. At the same time, they point out a legal gap where accountability remains unclear when an agent is manipulated and damage occurs.