Hacking AI Agents: 5 Attack Patterns Every Team Should Test
A chatbot that only answers questions is low risk. An agent that reads email, browses the web and calls tools is a different animal — prompt injection now has hands. These are the five patterns I test first.
1. Indirect prompt injection
Hide instructions in content the agent will read — a web page, PDF, ticket or email — and see if it obeys them instead of the user.
2. Tool hijacking
Get the agent to call a tool the user never asked for: sending email, creating records, changing settings.
3. Data exfiltration through output
Trick the agent into putting sensitive data into a link or markdown image that the client loads automatically.
4. Poisoned tools (MCP)
A malicious or changed tool description can steer the agent silently. Review, pin and hash every tool definition.
5. Excessive agency
Agents often hold far more permission than any single task needs.
- Read-only by default
- Per-tool, short-lived credentials
- Human approval for destructive or outbound actions
Tools mentioned
Treat everything an agent reads as hostile and every tool it holds as a privilege — then test both.