Course Objective & Scope
Unlike a single-turn chatbot, an autonomous agent decomposes sub-goals, reads external data, updates its memory and makes decisions across dozens of steps. In an Agent Goal Hijack attack (OWASP Agentic AI ASI01), manipulated data encountered mid-workflow rewrites the agent's objective, turning it into a multi-step operator serving the attacker's goal.
Through live labs, this course explores objective diversion in ReAct and plan-and-execute loops, long-term memory poisoning and sub-agent task corruption, showing participants how to design immutable task contracts and trajectory monitors.
Who Should Attend?
- Engineers building autonomous agents with LangGraph, AutoGen, CrewAI or custom orchestrators
- AI security specialists and red team operators
- AI architects designing multi-step enterprise workflow automations
- Prerequisite: familiarity with agent architectures (planning, memory, tool calling) and prompt injection
Key Takeaways
- Distinguish multi-step agent goal hijacking from single-turn prompt injection
- Construct goal diversion scenarios across ReAct, reflection and re-planning loops
- Detect delayed-trigger attacks planted in persistent episodic and semantic memory
- Implement plan-then-execute architectures that lock original user intent before reading untrusted data
- Integrate an independent guardian/judge monitor that validates action-to-goal alignment at every step
Curriculum
Autonomous Planning Loops and ASI01 Agent Goal Hijack
- How goal state is represented in ReAct, Plan-and-Solve and reflection architectures
- How untrusted observations overwrite the primary objective during re-planning steps
Direct, Indirect and Delayed Goal Hijacking
- Diverting tasks via web search results, calendar invites, support tickets and repository files
- Planting persistent rules in long-term memory (memory poisoning) to hijack future sessions
Attack Lab: Diverting an Autonomous Workflow
- Hijacking a multi-step research and procurement agent in a live sandbox
- Analysing trajectory logs to pinpoint the exact point of goal divergence
Architectural Defense: Intent Locking and Plan-Then-Execute
- Separating control flow from data flow with CaMeL and privileged planner patterns
- Memory-write validation and provenance tagging for persistent state
Runtime Trajectory and Intent Verification
- Independent intent verifier comparing every proposed tool call against the original user request
- Step budgets, trajectory drift scoring and automatic human-in-the-loop escalation
Other Courses in This Category
-
Covers tool poisoning, rug pulls, tool shadowing and supply chain risks in Model Context Protocol (MCP) servers, third-party agent tools and A2A integrations, and how to build a secure MCP architecture.
- Live Course
- 5 modules
-
Teaches how to prevent remote code execution (RCE) and injection vulnerabilities caused by executing LLM- and agent-generated Python, SQL, shell or template outputs using AST validation and safe output handling.
- Live Course
- 5 modules
-
Teaches how to isolate code-executing, file-processing and browser-using AI agents inside secure sandboxes using Firecracker microVMs, gVisor, Kata Containers, WebAssembly and strict network egress controls.
- Live Course
- 5 modules
-
Hands-on training on direct prompt injection, jailbreak techniques and system prompt leakage, showing developers how to detect and defend against them with input classifiers, instruction hierarchy and tools such as garak.
- Live Course
- 6 modules
-
Covers hidden instructions delivered through web pages, emails, documents, RAG sources and MCP tool outputs, data exfiltration chains, and architectural defences such as spotlighting, the dual-LLM pattern and CaMeL.
- Live Course
- 5 modules
-
Teaches how sensitive data leaks from LLM applications through memorisation, secrets in system prompts, unauthorised RAG access, cross-tenant leakage and logs, and how to prevent it with permission-aware retrieval and DLP controls.
- Live Course
- 5 modules
Get in touch
