Hijacking AI Agents, Part 1: The Trust Bug
An AI coding agent is useful because it reads things for you and acts on them. It reads your files, your instructions, a skill you installed, a web page you asked it to summarize, the description of a tool it can call. Then it does something: edits a file, runs a command, fetches a URL, calls a tool. That is also exactly why it can be hijacked. The agent has historically had a hard time telling the difference between data it was asked to look at and instructions it is supposed to follow. Everything it reads lands in the same place, and anything in that place can speak in the imperative voice. This post is about that single flaw, because once you see it, every agent hijack you will read about is the same trick wearing different clothes. ...