agent-goal-hijack-defender

To prevent prompt injection from changing your agent's objective, you must pin the goal record outside the model context and apply authenticated mutation control. This restricts goal changes to the authorizing principal and detects scope expansion attempts from untrusted tool results or recalled memory.

Agent goal hijacking is the quiet redirection of a multi-step agent's objective by untrusted content during execution. Plan drift happens when tool results or peer-agent messages introduce scope expansion or task substitution, causing the agent to execute an unintended target instead of the pinned goal.

To secure a multi-step agent against objective substitution during replanning, implement step tracing and deviation checks at replanning checkpoints. This validates each new step against the pinned goal, detects replan storms, and triggers drift responses to halt, re-ground, degrade, or contain the execution.

Yes, you can detect scope expansion when an agent browses untrusted documents by applying deterministic step tracing checks against the pinned goal. This flags deviations before side effects accumulate, keeping the original objective intact even if the content attempts redirection.

Model-mediated checks for agent security are weaker than deterministic checks and may miss subtle plan drift or scope expansion signals. They should be used only when deterministic validation against the pinned goal record is not possible, as they rely on the model to evaluate its own deviation from the objective.

You should not use a pinned goal record for agent scope control if your agent operates in a single-step context without planning loops or tool results. The mechanism targets multi-step agents exposed to untrusted content where replanning checkpoints and peer-agent messages create hijack risks.