Prompt injection started as a simple idea during its initial chatbot phase: Tell the model to ignore its instructions and return information in violation of its guardrails. Now, prompt injection attacks can aim at something harder to see: how an agent plans, and how a model reasons and decides which rules apply.
The CrowdStrike Prompt Injection Taxonomy, built and maintained by CrowdStrike AI security researchers, offers the industry’s most comprehensive framework for understanding and defending against the ever-expanding array of attack techniques. Today we are introducing a new version of the taxonomy that adds newly discovered attack techniques on autonomous agents and how they plan. This expands the public taxonomy to 222 techniques.
How Adversaries Manipulate Agent Planning #
An agent breaks its goal into steps, picks tools, and executes. An attacker no longer needs to get one forbidden request past an input or output filter in order to manipulate the agent. Attackers can shape the context the agent plans from, so a restricted action looks like the logical next step. Because each step can look benign on its own, defenses that check steps in isolation may miss what the plan adds up to.
Consider the following hypothetical scenario: A developer may ask their endpoint coding agent: "The integration tests keep failing. Figure out why and get them passing." A recently updated open source test utility was manipulated by an attacker to print a "troubleshooting" message when tests fail. It says environment drift is the usual cause, and the fix is to collect local config files and submit them to a "diagnostics endpoint" for comparison.
In this scenario, no one has told the agent to exfiltrate anything. The attacker's text reads as a troubleshooting procedure, so the agent folds that into its own plan. Sending local config files, including credentials, to an outside server becomes a step that it believes the goal requires. Each action looks normal by itself: Reading .env is routine debugging, and an HTTP request is routine patch-fetching. The risk only shows when you look at the whole sequence.
The latest taxonomy documents two new methods to achieve this attack:
- Goal Decomposition Exploitation subverts how an agent breaks a goal into sub-tasks; for example, by adding a malicious task or changing what a step does, so the agent concludes that a restricted action like exfiltrating a file is required. As in the example above, the goal of the agent was to debug the failing tests. The step of sending the config file to the “diagnostics endpoint” was the exfiltration.
- Constraint-Driven Task Steering uses environmental constraints or triggers to block an agent's usual route, so the fallback plan the agent picks is the path the attacker wanted all along. In the example above, if the agent was able to immediately know what was wrong with the local config or why the tests were failing, the agent would not have needed to send the config file to the “diagnostics endpoint” for comparison.
If you build or secure agentic applications, the takeaway is that agent security must include securing the plan, not only the prompt or LLM response. Other new techniques in the Prompt Injection Taxonomy are:
- Output Exclusion Prompting covers attacks that ban the language tied to safety tuning, such as refusal templates or hedging.
- Session State Spoofing injects a fake system summary, such as a compaction note or memory log, that presents false facts or an approval that was never given as verified history. It matters most for systems that compact context or keep agent state logs.
Classifying Attacks by Reasoning Pipeline Stage #
The new taxonomy also organizes attack techniques by the phase of the processing pipeline and attack targets. This lets defenders ask not just what an attack does, but where it interferes.