# Goal Hijack Execution Divergence (Instance-Resolved)

- **Severity:** High
- **Signature ID:** `7f3c1d9e-4b2a-4f8e-9a61-2c5d8e0b7431`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0043 (Craft Adversarial Data)
- **OWASP:** LLM01 (Prompt Injection), LLM06 (Excessive Agency), ASI01 (Agent Authorization and Control Hijacking)

## Summary

This rule watches for a specific pattern in AI agent sessions: the agent runs a command that came from an external source (like a downloaded script), or it edits its own configuration files, and then shortly afterward does something suspicious like stealing credentials, setting up persistence, or quietly sending data out. That combination suggests the agent's original task has been silently redirected by someone else's instructions.

## How the attack works

An AI agent session pulls in content from the network -- a curl'd script, a base64-encoded payload, a downloaded file made executable -- and runs it as if it were a legitimate next step. Alternatively, the agent edits files that control its own behavior, such as CLAUDE.md, AGENTS.md, .cursorrules, or MCP configuration files. Within the same session and a short time window, the agent then does one of: mutates its directive files again, harvests credentials, sets up a persistence mechanism, or exfiltrates data through file reads or command substitution. The rule ties all of this together by tracing process lineage back to a single agent session, so it never mixes up unrelated sessions or reused process IDs.

## Why it matters

An attacker who can inject instructions into an agent's inputs can redirect its goals without ever touching the model directly, potentially exfiltrating data, planting persistence, or stealing credentials using the agent's own permissions and trust level.

## What you can do

- Restrict which files an agent is allowed to write to, especially its own instruction/config files (CLAUDE.md, AGENTS.md, .cursorrules, MCP config files) -- require human review for changes to these.
- Avoid letting agents pipe remotely-fetched content directly into an interpreter or shell without an intermediate review step.
- Treat this as a report-only signal, not a blocking control -- investigate the flagged session manually since the rule cannot see the actual goal-hijack, only its aftermath.
- Expect and tune around known benign patterns like developer bootstrap scripts, dotfile managers (chezmoi, stow, yadm), and legitimate repo onboarding that edits agent config files in the same session as reading a .env file.

## Known benign look-alikes

- Developer bootstrap run through the agent -- a vendor install one-liner (remote script piped to a shell) whose installer then appends to ~/.zshrc or registers a launch agent. Ingestion + persistence in one session, benign.
- Agent-driven repository onboarding that legitimately edits CLAUDE.md / AGENTS.md / .cursorrules and, in the same session, reads a .env file or copies a config -- directive mutation plus a divergence class, benign.
- Dotfile managers (chezmoi, stow, yadm) invoked by the agent, which fetch remote dotfiles and then rewrite shell profiles and ~/.ssh/config.
- Backup or artefact-publish steps that tar/gzip a directory and pipe it to curl or scp toward an internal store -- covert-egress class, benign intent.
- Operator-approved secret-rotation runbooks executed by the agent that read ~/.aws/credentials or run `aws ... get-secret-value` and post the result onward.
- CI containers where the agent both installs tooling from the network and writes service units in the same short window.

## References

- https://atlas.mitre.org/techniques/AML.T0051
- https://atlas.mitre.org/techniques/AML.T0043
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/goal-hijack-exec-divergence