Hijacked Agent Intent

What Is Hijacked Agent Intent?

An AI agent cannot tell retrieved data from instructions unless you configure it to. A CRM note, a support ticket or a web page can be written by someone who expects a model to read it. You'll follow an instruction planted through a public support form onto a customer record, then watch an agent asked only to summarise that record email billing details to an outside address. You'll compare what was requested against what the trace shows, deny the call, and stop trusting retrieved content by default.

What You'll Learn in Hijacked Agent Intent

• Recognize intent subversion: an AI agent treating instructions embedded in retrieved content, such as a CRM note or a document, as commands it should follow
• Distinguish a stated user intent from an agent's actual tool-call trace, and use that comparison to catch an unrequested action
• Deny a sensitive tool call, such as sending data to an external address, that the user never actually requested, even when the call would otherwise succeed
• Trace a hijacked action back to its source: the specific line of retrieved content that carried the injected instruction
• Configure an MCP client to stop trusting retrieved content by default and require human consent on sensitive actions like external sends

Hijacked Agent Intent — Training Steps

1. A Front Door That Writes to the File

   Sarnholt Systems takes customer requests through a public form. Bob is not a customer, and he does not need to be: the form asks who you are and then believes the answer.

2. Stored Word for Word

   The portal says plainly what happens to anything submitted through it. That single sentence is the whole opportunity.

3. Writing in the Customer's Voice

   Bob fills the form in as Corinne Marchetti, the real contact on account SRN-4471. Nothing verifies that claim. The message he leaves is not written for a human reader at all: it is phrased as an instruction, in case something automated reads it.

4. On the Account File

   The portal confirms it. His text is now part of account SRN-4471's record, sitting among genuine notes written by Sarnholt's own staff.

5. Nothing Left to Do

   The payload is planted and inert. It only becomes an attack when a tool retrieves it and an agent treats what it retrieved as instructions.

6. A Straightforward Request

   Monday at Sarnholt Systems. Alice, a support operations lead, opens her inbox to a message from Diego Farrow, the account owner for Marchetti & Voss Logistics. He is swamped before a call and asks her for a quick summary of the account's recent notes. It is exactly the kind of task Agent Host handles every day.

7. Pulling Up the Account

   Before asking the agent to do anything, Alice opens the record herself so she knows what it actually contains.

8. A Familiar Account

   The record loads: Marchetti & Voss Logistics, active on the Growth plan, Diego listed as the account owner. Nothing about it looks unusual.

9. Connecting Agent Host's Tools

   Sarnholt's support team uses Agent Host, the company's MCP client, for tasks like this one. crm-reader-mcp and outreach-mcp are already connected and approved: one reads CRM records, the other can send email on the user's behalf.

10. The Tools It Has

    Before asking anything, it's worth knowing what Agent Host can actually do on Alice's behalf.