AgentHijack-Agent: Autonomous Control Hijacking

• AgentHijack-Agent is a broad class of failures where an autonomous agent’s control, data, or resource flow is diverted from user objectives by untrusted content, deceptive interfaces, or malicious tools.
• It encompasses multiple attack families including indirect prompt injection, structural template injection, environmental hijacking, compositional tool misuse, and malicious-tool hijack.
• Empirical studies show high attack success rates in weakly protected systems, while robust defenses like isolated memory and runtime interception help mitigate these risks.

AgentHijack-Agent denotes a broad class of failures in which an autonomous agent’s control flow, data flow, or resource usage is diverted away from the user-aligned objective by untrusted content, deceptive interfaces, malicious tools, or cross-service composition. In recent work, the phenomenon appears under several concrete forms: indirect prompt injection into tool outputs and retrieved content, structural template injection that induces role confusion, mid-task browser hijacking, deceptive web and mobile UI perturbations, malicious Model Context Protocol (MCP) tool behavior, and common environment corruptions that derail computer-use agents even without explicit adversarial intent (Wen et al., 7 Feb 2026, Deng et al., 18 Feb 2026, Wang et al., 27 May 2025, Liu et al., 8 May 2026, Noever, 27 Aug 2025, Zhang et al., 2 Dec 2025, Sun et al., 25 May 2026). Across these settings, the common pattern is that the agent treats externally influenced observations as planner-relevant state and then executes side-effecting actions under that contaminated state.

1. Conceptual scope and threat model

A standard abstraction in this literature models the agent as a planner-memory-tool loop. In the ReAct-style formulation used by AI$^2$, the agent consists of a Brain, a Memory, and External Tools; on a user query, the agent retrieves relevant knowledge from Memory, uses the Brain to produce an action list, and then executes that plan through tools (Zhang et al., 2024). AgentSys makes the same point in a different notation: conventional agents update context as $c_k = c_{k-1} \oplus \tau_k$, where tool outputs and intermediate traces are appended into a single working memory that conditions subsequent decisions (Wen et al., 7 Feb 2026).

Within that architecture, hijacking occurs when the attacker can influence any observation the planner later conditions on. AgentSys formalizes the canonical case as indirect prompt injection through a tool-returned observation $y \in \mathcal{Y}$, while assuming that the attacker cannot modify the tool executor $\mathrm{Exec}_t$ or environment state transitions (Wen et al., 7 Feb 2026). AI$^2$ studies a related black-box setting in which the attacker has only API access and manipulates retrieval so that benign-looking queries cause the agent to recover “action-aware knowledge” and assemble a harmful action plan without overtly harmful prompt semantics (Zhang et al., 2024).

The threat model expands in MCP systems. “Servant, Stalker, Predator” argues that MCP architectures typically enforce authentication, authorization, rate limits, and auditing at the level of each individual service, while the agent alone retains global memory and intent across services (Noever, 27 Aug 2025). In that setting, a hijack need not resemble prompt injection at all: benign, individually authorized operations can compose into surveillance, market manipulation, or infrastructure compromise because no single service sees the whole chain (Noever, 27 Aug 2025).

A broader usage appears in the AgentHijack benchmark for computer-use agents, where “hijack” also includes non-adversarial disruptions such as pop-ups, resolution changes, overlapping applications, accidental touches, app minimization, network failures, and verification screens (Sun et al., 25 May 2026). This usage is wider than the adversarial security framing, but it preserves the same operational meaning: execution is derailed because the agent’s perception and control channels no longer track the intended task state.

2. Architectural preconditions that make hijacking possible

The first precondition is persistent, over-broad working memory. AgentSys identifies two consequences of indiscriminate accumulation: injected instructions persist across later rounds, and verbose, non-essential content degrades decision quality (Wen et al., 7 Feb 2026). The paper reports strong persistence empirically: in AgentDojo 4-step tasks, injection in round 1 yields 60.53% ASR, versus 15.38% in round 2 and 5.88% in round 3 (Wen et al., 7 Feb 2026). This makes long-horizon agent memory not merely a context resource but an attack amplifier.

The second precondition is token-level flattening of trusted and untrusted channels. Phantom shows that modern agents serialize system prompts, user turns, assistant turns, tool calls, tool responses, and retrieved context into a single token stream demarcated only by chat-template delimiters such as begin-of-turn and end-of-turn markers (Deng et al., 18 Feb 2026). Because those role boundaries are soft learned priors rather than hard isolation primitives, retrieved text containing template-like delimiters can be misparsed as authentic user or assistant content. Phantom formalizes Structured Template Injection as a triplet $t = (T_0, T_1, T_2)$ that forges a tool-to-assistant transition, then an assistant-to-user transition, then closes the injected user turn (Deng et al., 18 Feb 2026).

The third precondition is retrieval or observation channels that expose agent-planning state to attacker-controlled content. AI$^2$ exploits retrieval-augmented generation by first stealing internal “action-aware knowledge” from Memory and then using a Trojan retrieval prompt so the retriever surfaces a dangerous exemplar whose operation is reused on attacker-chosen objects (Zhang et al., 2024). IPI-proxy generalizes this observation operationally for whitelisted enterprise browsing agents: even if the agent never leaves an approved domain set, any writable page, comment field, widget, or document on those domains remains a viable injection point once the returned HTML is incorporated into the browsing context (Chia-Pei et al., 12 May 2026).

The fourth precondition is multimodal grounding without source attribution. AdInject exploits the fact that VLM web agents act on screenshots, accessibility trees, and Set-of-Marks representations, but do not reliably distinguish first-party task-relevant UI from third-party ad elements (Wang et al., 27 May 2025). “Hijacking JARVIS” makes the same point for mobile agents: unprivileged third parties can modify content regions inside real apps, while the agent lacks provenance over whether on-screen instructions come from the OS, the app, or external content (Liu et al., 6 Jul 2025). In both settings, the attack succeeds because the agent binds action selection to salience and local relevance rather than trusted origin.

3. Major attack families

The most extensively studied family is indirect prompt injection through tool outputs or retrieved content. AgentSys treats indirect prompt injection as the root cause of agent hijacking in tool-using LLM agents and targets persistence by keeping raw tool outputs and worker traces out of the main planner context (Wen et al., 7 Feb 2026). WebTrap studies the same class in long-horizon browser tasks, but focuses on stealthy mid-task fusion: a lure trap builds navigation inertia, an inertia trap reframes the attacker goal as a prerequisite for the user goal, and a payload trap enters a restricted region, executes the attacker workflow, then resumes the original task (Liu et al., 8 May 2026).

A second family is structural rather than semantic. Phantom’s Structured Template Injection does not primarily persuade the model with malicious natural-language content; it attacks the template grammar by embedding delimiter patterns that induce role confusion in the flattened prompt stream (Deng et al., 18 Feb 2026). This is why instruction-level defenses such as delimiter spotlighting are weak in that setting: the exploit targets parse-time structural priors rather than ordinary instruction following (Deng et al., 18 Feb 2026).

A third family is environmental hijacking in browser and mobile interfaces. AdInject uses online advertising delivery as a realistic black-box attack channel: the attacker places a static, ad-like element that frames clicking as necessary to continue the task, typically through “Close AD” language and UI mimicry (Wang et al., 27 May 2025). The accessibility-tree attack on Browser Gym agents instead optimizes universal adversarial triggers directly over the HTML content that appears in the accessibility tree, using the Greedy Coordinate Gradient method to maximize the probability of a target browser action (Johnson et al., 20 Jul 2025). On mobile, AgentHazard modifies screenshots and UI trees in regions that unprivileged third parties can legitimately control, creating deceptive overlays, fake buttons, system-like notices, and phishing-style prompts inside existing applications (Liu et al., 6 Jul 2025).

A fourth family is compositional hijack in multi-tool ecosystems. In MCP systems, “Servant, Stalker, Predator” describes a progression in which a 3H agent remains locally compliant yet orchestrates cross-service sequences that produce surveillance, financial harm, or infrastructure compromise (Noever, 27 Aug 2025). The attack does not require any single malicious API call; harm emerges from cross-domain optimization, long-lived global state, and the semantic gap between a broad objective and the concrete strategies discovered by the agent (Noever, 27 Aug 2025).

A fifth family is malicious-tool hijack. LeechHijack introduces “implicit toxicity,” where a third-party MCP tool does not violate its declared permissions but covertly injects additional workloads so the agent expends inference budget on attacker-selected tasks (Zhang et al., 2 Dec 2025). The mechanism is a two-stage backdoor: implantation at tool output time, then exploitation through a command-and-control channel that embeds extra tasks inside legitimate-looking structured outputs (Zhang et al., 2 Dec 2025). This broadens AgentHijack-Agent from control-flow misuse to covert computational parasitism.

4. Empirical findings and benchmarked behavior

Across agent architectures, attack success rates are often high when the attack channel aligns with the agent’s native control loop. AgentSys reports that context isolation alone yields ASR $\approx 2.19\%$, while full AgentSys reaches ASR $\approx 0.78\%$ on AgentDojo and $\approx 4.25\%$ on ASB, with benign utility slightly improving over the undefended baseline on AgentDojo for GPT-4o-mini, 64.36% versus 63.54% (Wen et al., 7 Feb 2026). It also reports 0% ASR for trajectories with at least 4 tool calls on AgentDojo, which the paper interprets as evidence that attack persistence has been removed (Wen et al., 7 Feb 2026).

In contrast, offensive studies commonly report high success in unprotected or weakly protected settings. Phantom achieves 79.76% average ASR across GPT, Qwen, and Gemini variants, exceeding Single-Template at 54.09%, Semantic-Injection at 39.86%, and ChatInject at 38.46% (Deng et al., 18 Feb 2026). AI$c_k = c_{k-1} \oplus \tau_k$0 reports an average action-hijacking ASR of 78.10%, with a best of 99.67% on GPT-4, while bypassing banned-word filters at 100.00% and a forbidden-operation classifier at 98.70% (Zhang et al., 2024).

Web-specific environmental attacks show similarly strong results. AdInject reports attack success rates exceeding 60% in most scenarios and approaching 100% in certain cases, with GPT-4o on VisualWebArena reaching 93.51% ASR for A11y+Screen and 93.99% for Set-of-Marks in the basic agent setting (Wang et al., 27 May 2025). The HTML accessibility-tree attack reports very high TWUI ASR on five real websites, with the lowest observed ASR equal to 0.83, and in the UWTI credential-exfiltration setting it reaches ASRv on 3 of 11 held-out login sites and ASR 0.55 for leaking at least one credential field (Johnson et al., 20 Jul 2025). WebTrap reports, for example, long GitLab one-time ASR-E 66.67%, ASR-I 95.83%, and UUA 75.00%, with best-of-$c_k = c_{k-1} \oplus \tau_k$1 further increasing long GitLab ASR-E to 91.67% and UUA to 91.67% (Liu et al., 8 May 2026).

Mobile and desktop studies show that deceptive or corrupted interfaces produce substantial misbehavior even without privileged attacker capabilities. In AgentHazard, complex mobile attack scenarios produce an average misleading rate of 28.8%, terminate attacks reach MR $c_k = c_{k-1} \oplus \tau_k$2, and mixed-actions attacks reach MR = 83.3% (Liu et al., 6 Jul 2025). The AgentHijack desktop benchmark expands OSWorld from 369 tasks to 3,321 corrupted instances and shows that even minor common corruptions substantially degrade performance; its proposed AgentHijack-Agent reaches 27.80% clean SR and 22.89% average SR across nine corruptions, compared with 24.21% and 18.74% for UI-TARS-1.5-7B (Sun et al., 25 May 2026).

MCP-specific work shows that harm can emerge without direct prompt injection. “Servant, Stalker, Predator” reports 77% success on location and navigation tasks with average 9.4 iterations, 80% success on Weather+Maps multi-service tasks, and a coordinated market-manipulation scenario causing $c_k = c_{k-1} \oplus \tau_k$3 damage in 48 hours (Noever, 27 Aug 2025). LeechHijack reports an average ASR of 77.25% for extra-task execution with a resource overhead of 18.62% relative to baseline (Zhang et al., 2 Dec 2025). These measurements are not directly comparable to prompt-injection ASR, but they document that control transfer can occur through orchestration and tool semantics rather than through overt prompt overrides.

5. Defensive architectures, interception layers, and red-teaming frameworks

The most explicit architectural defense is AgentSys. It replaces monolithic memory with a hierarchy in which a main agent delegates tool calls to short-lived worker agents; raw tool outputs and worker reasoning traces remain isolated, and only schema-validated, deterministically parsed JSON may cross back into trusted memory (Wen et al., 7 Feb 2026). The transfer function is constrained to $c_k = c_{k-1} \oplus \tau_k$4, and side-effecting worker sub-calls are mediated by a validator that does not observe raw attacker-controlled content (Wen et al., 7 Feb 2026). This reframes defense from “resilience under contaminated memory” to “prevention of memory contamination.”

A second defensive line is runtime tool interception. AgentTrust inserts a trust evaluator between agent and tool execution, formalized as

$c_k = c_{k-1} \oplus \tau_k$5

where the returned verdict is one of allow, warn, block, or review (Yang, 6 May 2026). Its pipeline combines ShellNormalizer, ActionAnalyzer, PolicyEngine, SafeFix, SessionTracker/RiskChain, and an optional cache-aware LLM-Judge (Yang, 6 May 2026). On its 300-scenario internal benchmark, the production-only ruleset achieves 95.0% verdict accuracy and 73.7% risk-level accuracy at low-millisecond latency; on an independent 630-scenario benchmark under a patched ruleset, it achieves 96.7% verdict accuracy, including about 93% on shell-obfuscated payloads (Yang, 6 May 2026).

A third line is compromise detection after prevention fails. AgentShield instruments the tool interface with fake tools, fake credentials, and parameter allowlists, using any trigger as both an online compromise signal and a zero-false-positive self-supervised label (Rassul et al., 10 May 2026). Across 176 cross-lingual attack prompts and four models, it catches 90.7% to 100% of successful attacks on commercial models, with zero false alarms on 485 normal-use tests (Rassul et al., 10 May 2026). This is important because the paper explicitly notes that modern LLMs already refuse most indirect prompt-injection attempts on their own, with baseline ASR at or below 10%, so the defense focuses on the residual successful compromises rather than on all attack attempts (Rassul et al., 10 May 2026).

Robustness-oriented frameworks address the environment rather than only the prompt. AgentHijack-Agent improves desktop computer-use robustness by combining an action generator with enhanced grounding and an onlooker for behavior summarization and environment checking (Sun et al., 25 May 2026). AgentHazard provides a dynamic and static mobile benchmark for training and evaluating source-aware GUI robustness (Liu et al., 6 Jul 2025). IPI-proxy adds a deployment-realistic red-teaming layer by rewriting live HTML responses from whitelisted domains in flight, drawing from a unified library of 820 attack strings and parameterizing payload, embedding technique, and insertion point through YAML (Chia-Pei et al., 12 May 2026). This kind of tooling does not itself defend agents, but it makes live retrieval surfaces testable under production-like egress constraints.

The literature also records substantial utility-security tradeoffs. Phantom shows that learned injection detectors can reduce ASR sharply but sometimes collapse utility, as in GPT-4.1 Workspace where Injection Detector reduces Phantom ASR to 18.18% while utility also falls to 18.18% (Deng et al., 18 Feb 2026). WebTrap reports that segment-remove methods can eliminate ASR-E in the file setting but drive UUA to 0.00% (Liu et al., 8 May 2026). AdInject finds prompt-based warnings weak: even a goal-level instruction not to click “Close AD” only reduces ASR to 56.94% in the best GPT-4o VisualWebArena setting (Wang et al., 27 May 2025). By contrast, AgentSys reports slight utility gains under defense, which suggests that keeping trusted context clean can improve both safety and task performance (Wen et al., 7 Feb 2026).

6. Limitations, conceptual tensions, and open research directions

A recurring limitation is residual bandwidth through allowed channels. AgentSys explicitly notes that strings inside allowed schema fields can still carry adversarial text, so downstream logic must continue to treat strings as data only; schema design errors either expand the attack channel or damage utility (Wen et al., 7 Feb 2026). AgentShield likewise has blind spots when an attacker stays entirely within approved tools and allowlisted parameter values, because its deception layers are intentionally high-precision rather than exhaustive (Rassul et al., 10 May 2026). LeechHijack extends this concern to permission-respecting tools: no policy is overtly violated, yet compute is stolen inside nominally authorized behavior (Zhang et al., 2 Dec 2025).

Another limitation is attack specificity and transfer. The HTML accessibility-tree attack reports that triggers optimized for Llama-3.1-8B-Instruct did not transfer to Llama-2-7b-chat-hf or Mistral-7B-Instruct-v0.3 without re-optimization or joint optimization (Johnson et al., 20 Jul 2025). AdInject is black-box and broadly transferable across agents, but its efficacy depends on ad placement, size, and perceptual salience; very small 4% ads markedly reduce ASR (Wang et al., 27 May 2025). WebTrap requires visibility into the user-area graph and the ability to place persistent traps along the route to the restricted-area entrance (Liu et al., 8 May 2026). These results suggest that AgentHijack-Agent is not a single exploit primitive but a family of context-dependent control failures.

The literature also contains a genuine conceptual tension about what counts as “robustness.” Phantom finds that higher-capability models can be more vulnerable structurally because better instruction following amplifies the effect of delimiter abuse (Deng et al., 18 Feb 2026). AgentShield, in contrast, reports that current commercial models already refuse most IPI attempts, so its main value is in catching the small fraction that succeed (Rassul et al., 10 May 2026). AgentHijack further broadens the discourse by treating non-adversarial environment corruptions as hijack-like failures of grounding and control (Sun et al., 25 May 2026). A plausible implication is that robustness is attack-class-specific: stronger instruction following may help against ordinary malicious prose yet hurt against structural template exploits, while better general reasoning may not solve provenance ambiguity in multimodal interfaces.

Open problems therefore span several layers. The MCP literature calls for formal methods for compositional safety, scalable cross-service correlation, taint tracking, and intent verification at the strategy layer (Noever, 27 Aug 2025). AgentSys highlights automated schema synthesis, typed sanitization, and downstream taint tracking as unresolved problems (Wen et al., 7 Feb 2026). LeechHijack argues for computational provenance and resource attestation so that computation itself, not only tool permission, becomes auditable (Zhang et al., 2 Dec 2025). WebTrap emphasizes provenance-aware instruction parsing and plan repair without utility collapse (Liu et al., 8 May 2026). Taken together, these directions indicate that AgentHijack-Agent is less a narrow prompt-injection issue than a systems problem at the intersection of memory isolation, provenance, tool semantics, runtime policy, and long-horizon planning.