Agentjacking turns your AI agent into a privileged attack surface

Short summary

Agentjacking is a new attack class where malicious instructions hidden in external data—error reports, webpages, tool results—can hijack AI agents because models cannot reliably distinguish instructions from data. The post provides six concrete hardening strategies: separate data from instructions, apply least agency, require confirmation gates for high-impact actions, use short-lived credentials, audit all tool calls, and test for prompt injection in CI like you test code.

• •Agentjacking: attackers hide instructions in data agents read, exploiting the model's inability to distinguish data from commands
• •Hardening requires separating data plane from instruction plane, least agency, confirmation gates, scoped credentials, and audit logging
• •Treat agents like powerful new hires—guardrails are not add-ons but core to the product when money or sensitive actions are at stake

Generated with AI, which can make mistakes.