ASI01: Agent Goal Hijack
Agent Goal Hijack is essentially prompt injection, but its practical impact is amplified when the malicious instruction arrives indirectly. Imagine your agent reads a configuration file, a webpage, or a bug ticket as part of its job. The attack vector isn't the initial prompt you gave; it's data the agent consumes during its execution. The defense here isn't about sanitizing the initial input but securing the tool execution. This means implementing gate checks on tool calls: reject unauthorized tools, deny read access to sensitive directories like~/.ssh or .env, and establish a log of suspicious injection signal phrases. This prevents the agent from being subtly redirected to malicious goals by compromised data sources.
ASI02: Tool Misuse
Tool Misuse occurs when the agent’s underlying tools are sound, but the arguments passed to them are problematic. This could manifest as a delete command targeting a root directory or a write operation directed at a production system. The risk isn't in the tool itself, but in how the agent is instructed or how it interprets its task. For instance, an agent tasked with cleaning up temporary files might mistakenly interpret a path argument as a system-wide deletion target. The critical control is to validate and constrain the arguments before they are executed. This involves ensuring delete operations are scoped to safe directories, write operations are directed to intended, non-critical locations, and any operation with potentially destructive arguments requires explicit user confirmation or a highly restricted execution environment. Think of it like giving a powerful tool to an assistant: you trust the tool, but you must carefully review the specific instructions and materials they’re about to use it on.
