Agent Goal Hijacking Detection
This detects attempts to knock an AI agent off course by feeding it text that tells it to ignore its current job and do something else instead. It works by scanning what users type to the agent and what the agent says back for language patterns typical of this kind of redirection.
How the attack works
An attacker (or a compromised piece of content the agent reads) inserts text containing explicit commands like 'ignore your instructions' or 'forget the task', or uses subtler tactics: gradually shifting the topic, injecting false urgency, or prompting the agent to declare a new self-chosen goal. The agent, lacking a strong sense of which instructions are authoritative, treats this input as a legitimate update to its objective. It then abandons the assigned task and starts working toward whatever the attacker steered it to instead. The detection is purely pattern-based: it looks for characteristic wording in both the input to the agent and the agent's own output, not for the underlying intent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9e81918e-d983-4164-ab31-d0665f002751
- Severity
- High
Why it matters
A hijacked agent can leak data it had access to, take unauthorized actions on the attacker's behalf, waste compute and API resources, or simply fail to complete the job it was assigned, all while operators believe it is still on task.
What you can do
- →Keep a clear separation between trusted system instructions and untrusted user or document content passed to the agent, and don't let the latter override the former.
- →Log and periodically review agent task objectives against actual actions taken, so silent goal drift is visible.
- →Add a checkpoint where high-impact actions require the agent to restate the original task and confirm alignment before proceeding.
- →Expect false positives from legitimate topic changes and multi-step tasks, so tune review around context, not just keyword matches.
Known benign look-alikes
- Legitimate task pivot requested by an authorized orchestrator
- Agent correctly following up on a user's topic change in conversational context
- Multi-step task where intermediate steps may appear unrelated to final goal
- User clarifying or refining their original request
- A project manager legitimately informing a team that priorities have shifted and a new directive has been issued by leadership
- A user telling an agent 'instead of the full report, just give me the summary' as a legitimate scope refinement