{"resourceId":"crowdstrike-prompt-injection-taxonomy-agent-planning","versions":[{"version":"external-69c6a601aae446e4f4b9ee27ff0f99a0d49a594f162e85c6af5b7cc94b4db032","resource":{"id":"crowdstrike-prompt-injection-taxonomy-agent-planning","title":"New Prompt Injection Techniques Cover Agent-Planning Attacks","organization":"CrowdStrike","sector":"Cybersecurity vendor research (cross-sector)","geography":"Global","publishedAt":"2026-10-29","publicationDate":"2026-10-29","eventDate":"2026-10-29","sourceName":"CrowdStrike","sourceLabel":"Blog (Vanessa Villa, Dr. Jim Hoagland)","sourceUrl":"https://www.crowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks/","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement"],"finding":"CrowdStrike updated its public Prompt Injection Taxonomy to 222 techniques, adding agent-planning attacks (Goal Decomposition Exploitation, Constraint-Driven Task Steering) plus Output Exclusion Prompting and Session State Spoofing (fake compaction notes or memory logs), and now classifies attacks by reasoning-pipeline stage. A hypothetical example shows a coding agent sending credentials to an outside server because a poisoned test utility framed it as troubleshooting. The post ties the research to its Falcon Guardian AIDR product.","sledRelevance":"Governments and universities deploying AI agents (coding assistants, service agents) need threat models covering multi-step plans and memory, not only single prompts.","evidence":"Vendor research taxonomy with a hypothetical scenario; no measured prevalence or detection rates provided.","architectureImplications":"Agent deployments need sequence-level monitoring plus controls on memory/state logs and outbound requests.","governanceImplications":"AI use policies should cover agent planning, tool permissions and memory integrity, not only content filtering.","securityPrivacyImplications":"Credential exfiltration through benign-looking steps; spoofed session state could fabricate approvals that were never given.","caveats":"Vendor-authored and published the day of this edition; scenario is hypothetical; taxonomy completeness and product efficacy unverified.","streamIds":["crowdstrike"],"roles":{"sales":"Plan-level risk is the framing point: CrowdStrike argues agent security must cover the plan, not just the prompt. Interpretation: agencies piloting AI agents may need help updating AI governance and threat models. A bounded engagement could review one agent pilot's tool permissions and logging. The post offers a taxonomy and a hypothetical, so it cannot support claims that these attacks are prevalent in SLED or that Falcon Guardian detects them at any measured rate.","engineering":"Sequence visibility is the framing point: each step can look benign, so controls that check steps in isolation miss the plan. Interpretation: engineers should limit agent tool permissions, restrict outbound destinations, protect memory and compaction logs from injection, and log full action sequences. Proof of value should replay the taxonomy's techniques against the agency's agents. Claims about Falcon Guardian need independent validation; the taxonomy itself is useful as a test catalog.","delivery":"Test coverage is the framing point: the taxonomy can become a checklist for red-teaming agent pilots. Interpretation: delivery teams can schedule adversarial testing before agents gain write or network permissions, with owners in the AI program and security office. Acceptance criteria are proposals, such as documented tests for goal decomposition and session state spoofing and blocked egress to unapproved endpoints, since the source reports no field results."},"roleDetails":{"sales":{"customerProblem":"Agent pilots may be governed only for prompt-level risks, missing plan- and memory-level attacks.","stakeholders":["Chief AI or data officer","CISO","Application development lead","Privacy officer"],"discoveryQuestions":["Which agents can access files, credentials or the network?","Are agent action sequences logged?","Do agents keep memory or compaction logs?"],"valueHypothesis":"Plan-aware testing may reveal exposures before production; unquantified.","potentialEngagement":"Red-team review of one AI agent pilot using the taxonomy.","unsupportedClaims":["Prevalence of these attacks in SLED","Measured detection by Falcon Guardian","Completeness of the taxonomy"]},"engineering":{"fit":"Any agency building or adopting tool-using AI agents, including developer coding agents.","architectureIntegration":"Agent runtimes, endpoint telemetry, egress controls and memory stores.","prerequisites":["Agent inventory","Tool permission map","Egress allowlist"],"constraints":["Vendor taxonomy may evolve","Limited agent logging in some tools","Staff expertise"],"security":"Protect memory/state integrity; least-privilege tools; outbound restrictions.","proofOfValue":["Replay a goal decomposition attack","Test session state spoofing","Verify egress blocking"]},"delivery":{"work":"Adversarial testing and control hardening for agent pilots.","dependencies":["Test environment","Agent vendor cooperation","Security testing skills"],"ownership":"AI program lead with the security office.","skillsAdoption":"Developers and testers learn agent-specific attack techniques.","governanceCheckpoints":["Pre-production red-team gate","Permission review","Post-incident taxonomy mapping"],"acceptanceCriteria":["Tests executed for each new technique (proposed)","No agent egress to unapproved endpoints","Action sequences logged and retained"],"risks":["False assurance from partial testing","Vendor lock-in for detection","Rapidly changing techniques"]}},"retrievedAt":"2026-10-29T22:09:25-05:00","enrichedAt":"2026-10-29T22:18:51-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires new testing skills that SLED teams often lack.","procurementImplications":"AI agent contracts could require logging and permission controls aligned to such taxonomies.","operatingModelImplications":"Adds AI red-teaming to security operations.","sourceVerification":{"openedUrl":"https://www.crowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks/","referenceExcerpt":"agent security must include securing the plan, not only the prompt or LLM response.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}