OWASP Names AI Agent Goal Hijacking Top Security Risk for Agentic Applications
Summary
Updated Oct 6 — MCP trust gaps in agent-to-agent comms exploited across Google, JP Morgan, Weaviate, Rapid7, and government deployments by independent researcher.
- • OWASP's 2026 Agentic Top 10 ranks Agent Goal Hijack (ASI01) as the #1 risk
- • Agents treat retrieved webpages and documents as instructions, enabling goal redirection
- • Attackers need only plant malicious text where the agent will later read it
- • Unlike prompt injection, goal hijacking redirects multi-step planning and all connected tools
Updates
MCP agent-to-agent trust gaps enable injection propagation across networks
Model Context Protocol (MCP) — the standard for agent-to-agent communication — allows a malicious payload to spread from one compromised agent to trusted internal peers. Downstream agents follow injected instructions because they architecturally trust all internal agents.
Google, JP Morgan, Weaviate, Rapid7, and governments confirmed vulnerable
Researcher Syed Anas Mohiuddin tested agents at Google, JP Morgan Chase, Weaviate, Rapid7, the French government's interministerial digital directorate, and the US federal government — all exhibited exploitable MCP trust gaps within the past five months.
MCP servers store per-agent credentials; any trusted agent can access them
Proof-of-concept attacks exploit the fact that MCP servers store credentials for every agent and agents trust all internal peers. A lax special-purpose agent (e.g., translation or data analysis) becomes the entry point into the credential store.
Consequence: server-side request forgery enables data exfiltration
In many confirmed cases, well-crafted prompts propagating through the agent chain trigger server-side request forgery — causing web servers to make unauthorized network requests and enabling exfiltration of database contents and sensitive business information.
Details
ASI01: Agent Goal Hijack is OWASP's top-ranked agentic application risk
OWASP Top 10 for Agentic Applications 2026 (published December 2025) ranks Agent Goal Hijack first among ten risks for AI agents in production, designated ASI01.
Root cause: LLMs cannot reliably separate retrieved content from instructions
The underlying model processes fetched webpages, documents, and emails through the same pathway as direct user instructions — it cannot reliably distinguish the two, making retrieved content an attack vector.
Retrieval channel exploitable without any direct access to the agent
An attacker only needs to place malicious instructions where the agent will later fetch them — a webpage, document, or email. No access to the agent's input channel, users, or system prompt is required.
Goal hijacking vs. prompt injection: redirects multi-step planning
OWASP distinguishes ASI01 from standard prompt injection: goal hijacking manipulates the agent's objectives, task selection, and decision pathways across a multi-step workflow — not just a single model response.
Conventional input validation leaves the retrieval channel unprotected
Standard defenses — input validation, endpoint restriction, user authentication — guard only content the agent receives directly. They provide no protection against malicious content the agent fetches itself.
OWASP mitigation: treat all natural-language inputs as untrusted including retrieved
Primary OWASP recommendation: apply the same skepticism to retrieved content as to user-supplied text. Secondary: enforce minimum-privilege permissions for all agent tool access.
Risk scales with agent autonomy, tool count, and system access scope
As agents are granted more tools, broader access, and greater independence, the blast radius of a successful goal hijack expands proportionally — a growing concern as production agents gain real capabilities.
OWASP vulnerability analysis and attack mechanics for AI agent goal hijacking (ASI01).
What This Means
As AI agents are deployed with real capabilities — sending messages, running code, accessing financial systems — their inability to distinguish retrieved content from instructions becomes a critical production security flaw. OWASP ranking this as ASI01 signals that the security community considers agent goal hijacking the most urgent threat facing organizations deploying agentic AI today. Unlike prompt injection, which is bounded by a single response, goal hijacking can silently redirect an entire multi-step workflow — causing agents to act against the user's intent while appearing to function normally. Developers and security teams must treat retrieval pipelines as primary attack surfaces, not just trusted data channels, requiring trust boundaries and least-privilege design.