Hijacking AI Agents

A defensive research series on how an agentic AI coding assistant can be turned against you, and how to defend it.

Your AI coding agent reads almost anything you point it at: a skill file, a README, an issue, a tool’s description. Historically it has struggled to tell the difference between data it should summarize and instructions it should obey. That gap is the entire attack surface this series explores.

Responsible-use note. This is defensive research. The series documents real attack techniques so you can detect and defend against them. Live payloads and collector endpoints are redacted and the code shown is defanged. Do not deploy any of it outside an isolated test environment.

Hijacking AI Agents, Part 1: The Trust Bug

An AI coding agent is useful because it reads things for you and acts on them. It reads your files, your instructions, a skill you installed, a web page you asked it to summarize, the description of a tool it can call. Then it does something: edits a file, runs a command, fetches a URL, calls a tool. That is also exactly why it can be hijacked. The agent has historically had a hard time telling the difference between data it was asked to look at and instructions it is supposed to follow. Everything it reads lands in the same place, and anything in that place can speak in the imperative voice. This post is about that single flaw, because once you see it, every agent hijack you will read about is the same trick wearing different clothes. ...

Hijacking AI Agents, Part 2: Anatomy of a Hijack

Part 1 argued that an agent cannot reliably tell data from instructions, and that everything it reads melts into one trusted context. This part makes that concrete. We are going to install a normal, useful skill, ask it to do one harmless thing, and watch it quietly do four more. A Friendly Little Skill Say you install a popular community skill to help with git. The rendered file looks like this, abridged: ...