OWASP Ranks Agent Goal Hijack as Top Vulnerability; Reveals Key Attack Cases and Defense Strategies

OWASP designated Agent Goal Hijack as the #1 threat (ASI01) in the 2026 Agentic Application Security Threat Ranking. This attack exploits the fundamental vulnerability where AI agents fail to distinguish between instructions and surrounding content, mistaking hidden commands from external channels such as the web or documents for user instructions.

Major Attack Cases and Techniques

• Cryptocurrency Wallet Theft: A Grok activity controller hijacked a Bankr-generated wallet, transferring tokens worth approximately $150,000. The attackers used methods such as encoding commands in Morse code or Python snippets to hide them so they did not appear as instructions.
• Indirect Prompt Injection: Unit 42 identified 22 concealment techniques, including zero-size text and Base64, in web-based attacks. Cases were reported where AI ad reviews were forced to 'APPROVE' or PayPal transfers were attempted.
• Abuse of Development Tools: Tampering with the Nx build system caused tools like Claude Code and Gemini CLI to explore the filesystem, stealing GitHub tokens and SSH keys. This is one of the documented cases of attacks exploiting AI CLIs.
• Enterprise and Coding Agent Vulnerabilities: Data exfiltration and remote code execution (RCE) vulnerabilities were discovered in M365 Copilot (EchoLeak), Salesforce Agentforce (ForcedLeak), GitHub Copilot Chat (CamoLeak), and Cursor (CurXecute) via emails, PRs, Slack messages, etc. Notably, CamoLeak recorded a high risk level with a CVSS score of 9.6.

Three Mitigation Strategies Proposed by OWASP

1. Constrain agent: Limits the agent's scope of action by applying the principle of least privilege, introducing Human-in-the-Loop (HITL) approval, locking system prompts, and verifying runtime intent.
2. Distrust input: Treats all natural language inputs as targets for prompt injection checks. Data from connected sources such as RAG and emails must be sanitized before goal setting.
3. Watch and test: Assumes goal hijacking and detects activity drift against a baseline. Regular red team training and rollback verification are essential.

OWASP noted that it is difficult to completely block goal hijacking, emphasizing that removing unnecessary tools and reducing privileges are core defense strategies, as attackers exploit access permissions they already possess (tokens, connectors, etc.).