Agent Goal Hijack — An agent's objective is redirected mid-task by content it reads, so it pursues a goal nobody set.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
The agent is not broken and its reasoning is not obviously wrong — it is optimising faithfully for an objective that arrived from somewhere untrusted. It shows up as a plan that makes internal sense and external nonsense: a research agent that starts exfiltrating, a support agent that starts issuing refunds, a coding agent that starts disabling tests.
Controls that address it
- Mission scope enforced at the gate, not in the prompt — a hijacked objective still cannot reach an out-of-scope tool.
- Deny-by-default tool permissions, so a redirected goal has nothing new to reach for.
- Human approval on consequential effects regardless of how confident the agent is.
- Decision provenance recorded, so 'why did it choose this' is answerable after the fact.
- Abstention behaviour: an agent that cannot justify an action against its mission must refuse rather than proceed.
The evidence that proves the control fired
A policy_decision naming the mission scope evaluated, plus a refusal_receipt when the hijacked objective hits the boundary.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Scope enforcement limits blast radius; it does not detect the hijack itself. Detection needs behavioural baselining, and baselining a system that is supposed to act novelly is genuinely hard. Say so rather than claim coverage.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
Common questions
What is ASI01 agent goal hijack?
ASI01 agent goal hijack — An attacker steers the agent's objective away from what the operator intended, usually through injected content the agent treats as instruction.
How do you defend against it?
Separate instruction channels from data channels, constrain the goal at the policy layer rather than in the prompt, and gate every irreversible action so a hijacked objective still cannot act unilaterally.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.