Notifications
Clear all
Topic starter
02/08/2026 12:26 pm
TL;DR: AI agents can be manipulated through goal hijacking, memory poisoning, tool escalation, and recursive loops that corrupt mission context rather than code, according to Salt. The security problem is no longer prompt injection alone, but governing agent context, tool scope, and behavioural drift before legitimate access becomes malicious action.
NHIMG editorial — based on content published by Salt: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: What breaks when AI agents can rewrite their own mission context?
A: When mission context can be altered, access controls may still succeed while the agent pursues the wrong objective.
Q: Why do AI agents complicate privilege governance?
A: AI agents complicate privilege governance because they can request access, use tools, and execute actions faster than human review cycles.
Q: How can security teams detect memory poisoning in agentic systems?
A: Look for persistent changes in behaviour, repeated instruction patterns that do not match approved workflows, and unexpected decisions that recur across sessions.
Practitioner guidance
- Inventory every agentic access path Map each AI agent to the APIs, tools, data stores, and delegated identities it can reach.
- Separate mission data from retained memory Classify prompts, goals, memory, and feedback stores as governed assets.
- Enforce runtime tool boundaries Use explicit allowlists, scope-limited tokens, and step controls so agents cannot invoke sensitive APIs outside their assigned role.
What's in the full article
Salt's full article covers the operational detail this post intentionally leaves for the source:
- The specific attack patterns used to hijack agent goals, poison memory, and escalate tool use.
- The behavioural API security approach Salt describes for spotting mission drift across sequences of calls.
- The kinds of agent activity that can look authorized in logs while still being malicious in practice.
- The suggested red-teaming questions for testing whether your own agents can be manipulated.
👉 Read Salt's analysis of context poisoning and AI agent mission hijacking →
AI agent context poisoning: are your controls keeping up?
Explore further
02/08/2026 1:25 pm
Context poisoning is the governance failure behind many agentic AI incidents. The core problem is not that agents can act, but that organisations often treat context, memory, and tool access as implementation details rather than governed assets. Once those elements become the operational source of truth, attackers can redirect legitimate behaviour without tripping traditional access controls. Practitioners should treat context integrity as a first-class control boundary.
A question worth separating out:
Q: What should teams do when an AI agent starts using approved tools in unsafe ways?
A: Contain the agent before it completes further chained actions, revoke or narrow its tool scope, and preserve the full sequence of calls for review. Then validate whether the problem is a poisoned instruction set, compromised memory, or an over-broad delegation model. The goal is to stop repeat execution and restore a trusted context.
👉 Read our full editorial: Context poisoning and goal hijacking are the new AI agent attack surface
