What Is Agent Goal Hijacking?

Agent goal hijacking is a control-plane failure where an agent's objective state is redirected toward unauthorized outcomes. The attacker exploits memory, tool feedback, or context priority to override initial constraints.

This usually happens gradually across turns rather than in one obvious message. A benign workflow can drift into unsafe actions when context accumulation is not bounded by objective integrity checks and policy interrupts.

A plain analogy: you ask a navigation app to drive home, but repeated malicious rerouting nudges it somewhere else without explicitly saying "do not go home." Without checkpoints, the system follows the wrong destination.

The declared objective and the actual checkpoint enforcement are two different things, and the gap between them is exactly where goal hijacking lives: an agent can have a perfectly reasonable stated goal while still drifting, turn by turn, toward an unauthorized one, unless something is actively verifying the objective hasn't shifted before every side-effectful action.

Start free scan | See sample audit

Agentic Risk (Cursor, v0, Bolt)

Multi-step agent workflows are the highest-risk surface for this pattern, specifically because each additional turn is another opportunity for context to accumulate in a direction nobody explicitly authorized. This is closely related to, but distinct from, MCP impersonation and indirect prompt injection, both of which can serve as the entry point that starts a goal-hijacking drift. It's one of the "excessive agency" failure modes in the OWASP LLM Top 10.

Wrong vs. Right

# WRONG
planner: "autonomous"
tool_execution_guard: "model_confidence_only"

# RIGHT
planner: "autonomous_with_policy_gates"
tool_execution_guard: "allowlist + objective-hash verification + side-effect approval"

Copy-Paste Fix Prompt for Cursor/Claude

Add anti-goal-hijacking controls to my agent.
1. Persist canonical objective hash and compare before each tool call.
2. Add policy interrupt when objective tokens drift beyond threshold.
3. Require allowlisted tool/action pairs with tenant and role constraints.
4. Add simulation tests for multi-turn hijack attempts.
Return workflow patch + policy rules + tests.

For the broader set of practices this fits into, see our guide to AI agent security best practices.

Run a free URL scan. If it finds issues, paid plans unlock the full report, exact AI fix prompts, PDF export, and deeper audit coverage.