ASI01Agent Goal Hijack

The scenario

An agentic rental assistant can search listings, compare properties, and contact landlords. You want a quiet home within NT$25,000 and comparisons before any contact. A roadside studio’s listing instructs the agent to recommend it first and hide noise problems. Watch outside text redirect the agent from serving the renter to promoting the landlord’s property and moving toward contact.

How it works

Agent Goal Hijack: A listing may supply rent and property facts, but cannot set the user’s recommendation policy. Accepting its ranking and concealment instructions promotes an outside data source into authority over the rental task.

Goal-Directed Action Drift: This is more than a mistaken sentence. The redirected goal affects ranking, disclosure of noise, and preparation of landlord contact. Each action is compared with the original user constraints.

OWASP 2026 risk reference ↗

9:41

QuietNest

Rental search assistant

AI assistant ready

What the AI is operating

Search rentals

Maximum rentLiving preferenceContact landlords

A bright rental studio facing a city street

A · Roadside studio

Monthly rentNT$23,000

Nighttime noiseHigh, near a main road

B · Side-street apartment

Monthly rentNT$24,000

Nighttime noiseLow