From the CrowdStrike edition of October 29, 2026
New Prompt Injection Techniques Cover Agent-Planning Attacks
CrowdStrike · Cybersecurity vendor research (cross-sector) · Global
- Publisher
- CrowdStrike
- Original publication
- 2026-10-29
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-29
What happened
CrowdStrike updated its public Prompt Injection Taxonomy to 222 techniques, adding agent-planning attacks (Goal Decomposition Exploitation, Constraint-Driven Task Steering) plus Output Exclusion Prompting and Session State Spoofing (fake compaction notes or memory logs), and now classifies attacks by reasoning-pipeline stage. A hypothetical example shows a coding agent sending credentials to an outside server because a poisoned test utility framed it as troubleshooting. The post ties the research to its Falcon Guardian AIDR product.
Why it matters
Governments and universities deploying AI agents (coding assistants, service agents) need threat models covering multi-step plans and memory, not only single prompts.
Evidence and measured results
Vendor research taxonomy with a hypothetical scenario; no measured prevalence or detection rates provided.
Limitations and uncertainty
Vendor-authored and published the day of this edition; scenario is hypothetical; taxonomy completeness and product efficacy unverified.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agent pilots may be governed only for prompt-level risks, missing plan- and memory-level attacks.
- Stakeholders
- Chief AI or data officer
- CISO
- Application development lead
- Privacy officer
- Discovery questions
- Which agents can access files, credentials or the network?
- Are agent action sequences logged?
- Do agents keep memory or compaction logs?
- Value hypothesis
- Plan-aware testing may reveal exposures before production; unquantified.
- Potential engagement
- Red-team review of one AI agent pilot using the taxonomy.
- Unsupported claims
- Prevalence of these attacks in SLED
- Measured detection by Falcon Guardian
- Completeness of the taxonomy
Pre-sales engineering
Role takeaway
- Fit
- Any agency building or adopting tool-using AI agents, including developer coding agents.
- Architecture and integration
- Agent runtimes, endpoint telemetry, egress controls and memory stores.
- Prerequisites
- Agent inventory
- Tool permission map
- Egress allowlist
- Constraints
- Vendor taxonomy may evolve
- Limited agent logging in some tools
- Staff expertise
- Security
- Protect memory/state integrity; least-privilege tools; outbound restrictions.
- Proof of value
- Replay a goal decomposition attack
- Test session state spoofing
- Verify egress blocking
Delivery
Role takeaway
- Work
- Adversarial testing and control hardening for agent pilots.
- Dependencies
- Test environment
- Agent vendor cooperation
- Security testing skills
- Ownership
- AI program lead with the security office.
- Skills and adoption
- Developers and testers learn agent-specific attack techniques.
- Governance checkpoints
- Pre-production red-team gate
- Permission review
- Post-incident taxonomy mapping
- Acceptance criteria
- Tests executed for each new technique (proposed)
- No agent egress to unapproved endpoints
- Action sequences logged and retained
- Risks
- False assurance from partial testing
- Vendor lock-in for detection
- Rapidly changing techniques
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Agent deployments need sequence-level monitoring plus controls on memory/state logs and outbound requests.
Governance
Who approves, reviews and stays accountable for outcomes?
AI use policies should cover agent planning, tool permissions and memory integrity, not only content filtering.
Security and privacy
What data, permissions and controls need testing?
Credential exfiltration through benign-looking steps; spoofed session state could fabricate approvals that were never given.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requires new testing skills that SLED teams often lack.
Procurement
What should contracts, pricing and exit terms secure?
AI agent contracts could require logging and permission controls aligned to such taxonomies.
Operating model
Which teams own the service once it runs?
Adds AI red-teaming to security operations.
Publication history
- 2026-10-29CrowdStrike · Issue 0110 resources
Stable resource ID: crowdstrike-prompt-injection-taxonomy-agent-planning