Context-Jacking

Context-jacking is the abuse of an AI model’s conversation or retrieval context to redirect its behaviour away from intended policy. Attackers exploit hidden instructions, embedded data, or manipulated memory to influence outputs and actions. The risk rises when systems trust context without validating source, intent, and scope.

Expanded Definition

Context-jacking is an abuse of an AI system’s active context, including conversation history, retrieved documents, hidden instructions, and long-lived memory, to steer the model away from its intended policy. In NHI and agentic AI environments, the term matters because the model may not distinguish trusted operator intent from attacker-supplied context unless source, scope, and precedence are enforced.

Definitions vary across vendors, but the practical distinction is consistent: prompt injection targets the immediate prompt, while context-jacking manipulates the broader operating context that an agent uses to reason and act. That broader context can include tool outputs, retrieval-augmented generation content, memory stores, and orchestration metadata. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant because integrity, access control, and auditability are the operational safeguards that limit untrusted influence.

The most common misapplication is treating all retrieved or remembered content as equally trustworthy, which occurs when ingestion pipelines, memory writes, and tool outputs are not validated before being reused by the agent.

Examples and Use Cases

Implementing context controls rigorously often introduces latency and engineering overhead, requiring organisations to weigh agent flexibility against stronger validation and isolation.

• An assistant retrieves a poisoned knowledge-base page that embeds hidden instructions, then follows those instructions instead of the user’s request.
• A support agent stores memory from an untrusted conversation, and later uses that memory to bypass policy during a separate workflow.
• A tool response includes attacker-crafted text that is merged into the agent’s working context, altering task prioritisation or tool selection.
• A secrets-handling workflow exposes retrieval context to an agent, and the model learns to surface credentials or make unauthorised calls after being steered by injected content.

NHIMG research shows the stakes are not theoretical: the Ultimate Guide to NHIs reports that 96% of organisations store secrets outside secrets managers in vulnerable locations, which increases the chance that untrusted context will later influence an agent. For implementation patterns, the same concern appears in NIST SP 800-53 Rev 5 Security and Privacy Controls when organisations separate data ingestion, access enforcement, and monitoring.

Why It Matters in NHI Security

Context-jacking turns an AI agent’s memory and retrieval pathways into an attack surface. When the attacker succeeds, the agent may execute tool calls, disclose secrets, or alter decisions while appearing to follow normal automation. That is especially dangerous for NHIs because the agent often operates with service-account privileges, API keys, or delegated approvals that exceed human oversight.

NHIMG data indicates that 97% of NHIs carry excessive privileges and 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, a combination that makes context manipulation materially more damaging. The same operational weakness appears when organisations rely on stored conversation state without provenance controls, a concern aligned with the security principles in NIST SP 800-53 Rev 5 Security and Privacy Controls. The Ultimate Guide to NHIs also notes that only 5.7% of organisations have full visibility into their service accounts, which makes context-driven misuse harder to detect.

Organisations typically encounter the real impact only after an agent has already taken an unsafe action or leaked sensitive data, at which point context-jacking becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the Model Context Protocol (MCP) and why does it matter for security?
• What is MCP in the context of AI security?
• When is it appropriate to implement MCP in the context of AI systems?
• Why is organizational context important for AI agents?