AI Agents Can Be Steered Off Course: New Prompt Injection Techniques Target How Agents Plan

Prompt injection began as a simple trick: tell a chatbot to ignore its instructions and reveal something it should not. CrowdStrike says the attacks are now aimed at something harder to see, namely how an AI agent plans its steps and decides which rules apply. The company's AI security researchers have updated their public Prompt Injection Taxonomy with newly discovered techniques against autonomous agents, bringing the total to 222.

An agent breaks a goal into steps, picks tools and carries them out. According to CrowdStrike, an attacker no longer has to slip one forbidden request past a filter. Instead, they can shape the information the agent plans from, so a restricted action looks like the logical next step. Because each step can look harmless alone, defences that check steps in isolation may miss what the whole plan adds up to.

CrowdStrike gives a hypothetical example. A developer asks a coding agent to fix failing tests. A tampered open source test utility prints a fake troubleshooting message suggesting the agent send local config files to a "diagnostics endpoint". Nobody tells the agent to steal anything, yet it adds the step to its plan. Reading a config file and making a web request each look routine, so the risk only shows across the full sequence. CrowdStrike's advice to those building or securing agent-based applications is that security must cover the plan, not only the prompt or the model's response.