A multi-step hijack is an attack that looks harmless at each individual step but becomes malicious when the full sequence is considered. In agentic systems, this often means the agent is steered through chained actions until its own access produces an unauthorized outcome.
How a Multi-Step Hijack Works
A multi-step hijack is rarely obvious from one action in isolation. The attacker or prompt path is designed so each step looks legitimate, while the combined sequence shifts control, intent, or authority toward an unauthorized outcome.
The key idea is compositional. One action may request information, the next may reframe instructions, and a later step may trigger a tool, message, or side effect that only becomes harmful once the chain is complete.
Why the Sequence Matters More Than the Individual Step
Defenders who review only isolated prompts, messages, or tool calls can miss the pattern. The abuse is in the transition between steps, where context is accumulated, trust is inherited, or prior output is reused in a way the system did not intend.
This is why multi-step hijack belongs in the same family as chained abuse of trust. The harmful result may emerge through ordinary-looking intermediate actions that preserve plausibility until the final step converts them into unauthorized access, disclosure, or execution.
Where Multi-Step Hijack Becomes Dangerous in Agentic Systems
Agentic systems are especially exposed because they can carry state, reuse context, and act across multiple tools or services. An attacker does not need one overtly malicious instruction if they can steer the agent into a path where its own delegated authority is turned against its operator.
That makes the attack path important to understand alongside OWASP Agentic AI Top 10, CSA MAESTRO agentic AI threat modeling framework, and MITRE ATLAS adversarial AI threat matrix, because each helps frame how chained manipulation, tool misuse, and agent hijacking can unfold across a workflow.
Multi-step hijacks can also resemble broader access abuse patterns, where a sequence of permitted actions produces a result that no single step would have justified on its own.
Signals, Controls, and Response Thinking
The most useful defensive lens is to look for sequence-level anomalies, such as abrupt goal changes, context that is being progressively narrowed, or tool requests that only make sense after earlier manipulation. NIST Privacy Framework and NIST AI Risk Management Framework are useful where the concern is governing repeated interactions, context handling, and downstream impact rather than a single prompt event.
Multi-step hijack is ultimately a trust-boundary problem: the system keeps treating each step as safe because it appears local and incremental, while the attacker is relying on the cumulative effect of the chain to cross that boundary unnoticed.
Risk and Threat Considerations
Multi-step hijack is risky because the maliciousness is distributed across a chain, which makes it harder to detect, review, and block in real time. The individual steps can stay within policy while the overall sequence still produces unauthorized data exposure, tool misuse, or delegated-action abuse.
Failure mechanism: A system evaluates each action in isolation instead of tracking how earlier steps change the meaning, trust level, or authority of later steps, allowing the attacker to steer the agent into an unintended final state.
Impact: The outcome can include prompt or instruction capture, unauthorized tool execution, covert data movement, or a compromised agent workflow that appears legitimate until the end of the chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Multi-step hijack is a chained path to steering an agent off its intended goal. |
| ASI02 — Tool Misuse | The term covers malicious chaining that ends in unauthorized tool use. | |
| ASI10 — Rogue Agents | A hijacked sequence can turn a normally trusted agent into an unauthorized actor. | |
| Recommendation — Detect goal drift across action chains and block sequences that steer the agent off-task. Constrain tool calls to approved intents and deny sequences that repurpose tools unexpectedly. Monitor for behaviour that indicates an agent is acting outside its authorised operating pattern. | ||
| MITRE ATLAS | MITRE ATLAS | ATLAS maps adversarial AI techniques including prompt injection and agent hijacking. |
| Recommendation — Map the attack chain to adversarial AI techniques and use it for threat modelling and testing. | ||
| NIST AI RMF | AI Risk Management Framework | AI RMF addresses governance of AI risks that emerge across iterative use and downstream effects. |
| Recommendation — Assess cumulative AI workflow risk and verify controls over repeated interactions and delegated actions. | ||
Practitioner Guidance
What to watch for: Review agent workflows for accumulated context, not just single-step safety. If a sequence can progressively narrow the agent’s goal, inherit trust from prior outputs, or escalate the effect of a permitted action, treat that path as a candidate hijack pattern.
Practitioner takeaway: Defenses need to reason over the whole chain of actions, because a harmless-looking step can become dangerous only when combined with the next one.