Agents plan and act over many steps, so a single injected instruction can change what they try to achieve, not only what they say. Indirect injection through retrieved content is the main vector: a poisoned web page, ticket, or file tells the agent to exfiltrate data or take a different action, and the agent pursues the new goal with all of its tools.
Treat all retrieved and tool-returned content as untrusted data, never as instructions. Pin the agent's goal and allowed actions in trusted configuration, re-check planned actions against the original task before execution, and require human approval for high-impact steps.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2026Latest
#01asi01-2026 Agent Goal Hijack
