CrowdStrike: two new injection techniques target how an agent plans
CrowdStrike's taxonomy update names attacks that subvert an agent's plan rather than its prompt or its answer.
· CrowdStrike · Research by Vanessa Villa, Jim Hoagland
CrowdStrike's public prompt injection taxonomy now lists 222 techniques, including two aimed at how an agent plans: one adds a malicious sub-task to the plan, the other blocks the normal route so the agent falls back to the attacker's path.
01What happened
Vanessa Villa and Jim Hoagland published a new version of CrowdStrike's prompt injection taxonomy on October 29, 2026, taking it to 222 techniques. Four techniques are new, two of them aimed at the planning stage of an agent, and the update also groups existing entries by the pipeline stage they hit.
02How it works
Goal Decomposition Exploitation, logged as PT0227, feeds an agent a sub-task that makes a restricted action such as file exfiltration look necessary to finish the job. Constraint-Driven Task Steering, PT0228, blocks the route the agent would normally take so the fallback plan the attacker wants becomes the one it picks. Session State Spoofing, PT0240, plants a fake compaction note or memory log that presents an approval the user never gave as verified history. Output Exclusion Prompting, PT0237, bans the refusal and hedging language that safety tuning leans on.
03Who is affected
Agents that split a goal into sub-tasks and read untrusted content are the subject, and the worked example is a developer's endpoint coding agent that pulls in a poisoned test utility. CrowdStrike reports no tests against named products and publishes no success rates for the new techniques.
04What to do
Check whether your agent defenses inspect the plan and the whole sequence of steps, not only the incoming prompt and the model's answer, because CrowdStrike says checks that look at each step alone can miss what a sequence achieves together. Keep records of what agents were asked to do and which tools and systems they touched, so an incident can be scoped later.
Sources 2 links, all fetched
- 1crowdstrike.comCrowdStrike Research
- 2crowdstrike.comInteractive Taxonomy