What Is Agent Hijacking?
Agent hijacking is an attack that redirects an AI agent to carry out an attacker's goals instead of its user's, through instructions planted in content the agent reads while working, such as a web page, email, document or tool response. That route, indirect prompt injection, is how NIST defines the term. Stolen keys or tokens reach the same outcome by another route: whoever holds them acts as the agent. Either way, the actions carry the agent's legitimate identity and permissions, so they look authorized to every system that checks only who is asking.
Updated
What is agent hijacking?
NIST's Center for AI Standards and Innovation (CAISI), in a January 2025 technical blog, defines agent hijacking as "a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions." NIST calls it the latest form of an "age-old computer security problem" that arises when a system "lacks a clear separation between trusted internal instructions and untrusted external data." Indirect prompt injection itself was described in a 2023 paper, Not what you've signed up for.
The OWASP Top 10 for Agentic Applications, released in December 2025, lists hidden-prompt attacks under ASI01, Agent Goal Hijack. Agents operating on leaked credentials are a separate entry, ASI03, Identity & Privilege Abuse; grouping that route with hijacking is this page's reading, not OWASP's. Google's AP2 security considerations take a blunt position for payments: "Given the current state of agent security, AP2 assumes that preventing prompt injection attacks is infeasible."
Evaluations show why. In CAISI's tests on the AgentDojo framework, against agents built on Anthropic's upgraded Claude 3.5 Sonnet, attacks developed with red teamers at the UK AI Security Institute raised the attack success rate in AgentDojo's Workspace environment "from 11% for the strongest baseline attack to 81% for the strongest new attack" (NIST). In the wild, Palo Alto Networks' Unit 42 reported in March 2026 web pages carrying instructions that tried to push AI agents into buying running shoes, subscribing a victim to a paid plan, or sending $5,000 to an attacker-controlled payment account. These are attempts found on web pages: Unit 42 rates them by the attacker's intent, since it has limited visibility into which payloads succeeded.
How agent hijacking works
An illustrative shopping scenario shows the mechanics. Unit 42's retail fraud analysis lays out a hypothetical version of the same steps, where a deals site plants a gift card in the agent's checkout.
- 1.A user gives a shopping agent a mandate and a payment credential: household goods, a per-order cap, approved merchants.
- 2.While comparing prices, the agent reads a page that hides instructions in invisible text: add a digital gift card to the cart and send it to an outside email address.
- 3.The agent treats the text as part of its task and changes the cart.
- 4.At checkout, every identity check passes. The agent is registered, its token is valid, and the order sits under the per-order cap.
- 5.If the instruction persists in the agent's memory, it repeats on later tasks, each order individually within limits.
The credential route skips steps 2 and 3. Whoever holds the agent's keys or tokens transacts as the agent.
Signed mandates bound the damage. AP2 notes that even when injection causes poor choices, constraint enforcement keeps "the worst-case financial and logical impacts" bounded. They do not stop a hijacked agent from spending up to every limit it has.
Why agent hijacking matters in real-time systems
Identity answers "is this our agent?" Hijacking makes that question insufficient. What still distinguishes a hijacked agent is behavior: is it acting like itself? That takes a per-agent baseline (usual purchase rate, ticket size, merchants, categories, payees) compared with the last few minutes, at the moment of authorization.
The two halves have different freshness needs. A 30-day baseline can be recomputed every hour without losing anything. The recent window cannot lag, because a hijacked agent can act in bursts: a velocity count refreshed every five minutes lets a five-minute burst through untouched. The recent window has to be computed on demand against committed payment events and joined to the baseline in the same read.
Tacnode does not detect or block prompt injection, and it enforces nothing in a card network's or issuer's ledger. For a platform or issuer that holds the agent's payment events, it can compute that recent window against the latest committed data and serve it alongside the baseline in one snapshot, and hold per-agent limits and holds with transactional writes. Where velocity features break down under load is covered in real-time fraud detection architecture.
FAQ
Related terms
Agent overreach names an AI agent acting beyond the authority it was given: wrong item, over budget, unapproved merchant, or after the mandate was revoked.
Velocity checks are fraud rules that count or sum activity per card, device, IP address or account over a time window, and act when a threshold is crossed.
Agent spend limits cap what an AI agent may commit per transaction, period or agent. They are only as accurate as the spend total they are checked against.
Authorization-time context is everything a payment or purchase decision must read when it authorizes: mandate status, remaining budget, limits and recent spend.
A fleet control loop observes running AI agents, derives fleet state, adjusts policy, budget or routing, and has agents act on the change while still running.
The Visa Trusted Agent Protocol lets AI agents sign each request so merchants can verify a recognized agent, its browsing or payment intent, and reject replays.