Hidden instructions hijack the agent
Text the agent reads (a page, email, file) carries instructions it follows.
NIST AI 600-1 · Information SecurityOWASP LLM01OWASP Agentic ASI01
17incidents (primary) · 3 more as secondary
5read for controls · 12 not yet
7fixes reported
1repeats after a fix
Incidents per quarter
2025-Q3: 0 · 2025-Q4: 0 · 2026-Q1: 0 · 2026-Q2: 1 · 2026-Q3: 6 · 2026-Q4: 10
Developers
OpenAI · 3
Anthropic · 2
Perplexity · 1
TypeSafe AI · 1
Amazon · 1
Salesforce · 1
Google · 1
Where the chain broke
| Layer | Held | Did not hold | Not mentioned | Attacker's own | Not read yet |
|---|---|---|---|---|---|
| L1 Model Model provider | – | 1 | 4 | – | 12 |
| L2 Harness Agent framework vendor | – | 1 | 4 | – | 12 |
| L3 Application Deployer | – | 5 | – | – | 12 |
| L4 Infrastructure / target Organisation hit | – | – | 5 | – | 12 |
Controls for this risk, by layer
HeldFailedGot aroundMissing
| Control | Held | Failed | Got around | Missing | Not mentioned | Did not hold, last 6 quarters | Added in fixes | Most common reason |
|---|---|---|---|---|---|---|---|---|
| Tool allow-list L2 Harness | – | – | – | – | 5 | – | ||
| Confirmation after untrusted input L2 Harness | – | – | – | – | 5 | – | ||
| Outside content treated as data, not instructions L2 Harness | – | – | – | – | 5 | 1 | ||
| Prompt-injection detection L2 Harness | – | – | 1 | – | 4 | 1 | The filter saw one piece at a time | |
| Validation of tool inputs and outputs L2 Harness | – | – | – | – | 5 | 1 | ||
| Least-privilege access for the agent L3 Application | – | – | – | – | 5 | 2 | ||
| Human approval for high-impact actions L3 Application | – | 1 | 3 | 1 | 1 | 2 | No check on this action | |
| Segmentation of agent components L3 Application | – | – | – | – | 5 | – | ||
| Alerts on unusual tool use L3 Application | – | – | – | – | 5 | – |
9 of 9 controls for this risk not yet seen holding.
Fixes reported and what followed
Incidents
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
Also under this risk as a secondary risk: LR-2026-0250, LR-2026-0022, LR-2026-0087