OWASP identifies AI risk as top concern

OWASP, a global organization focused on software security, has identified objective hijacking (ASI01) as the leading risk for AI agents. This occurs when malicious instructions divert an AI agent from its intended purpose and exploit its permissions, potentially causing significant harm.

Microsoft 365 Copilot vulnerability exposed

Researchers from Aim Security showed that a simple email could have caused data leaks from Microsoft 365 Copilot as early as June 2025. The AI assistant processed the message in the background and executed encoded commands without the recipient needing to open it. Microsoft fixed the flaw, which was named EchoLeak (CVE-2025-32711).

AI agents gain broader action capabilities

Modern AI agents can perform a wide range of actions, including reading inboxes, consulting databases, executing code, calling APIs, and making payments. These agents often operate autonomously by following a pre-planned sequence of steps without requiring user approval at each stage.

Objective hijacking differs from prompt injection

The OWASP GenAI Security Project listed objective hijacking as the top risk in its Top 10 for Agentic Applications 2026 report, published in December 2025. Unlike prompt injection, which affects a single response, objective hijacking alters an AI agent's entire mission, making it more dangerous and harder to detect.

Language models struggle to distinguish instructions from data

A design flaw in language models makes it difficult for them to differentiate between instructions and data. This means that emails, web pages, and other content can be mistaken for commands. Attackers can exploit this by embedding malicious instructions in the content an AI agent processes, without changing its code.

AI agents receive data through two channels

AI agents get information from two sources: direct user requests, which are subject to authentication and access controls, and content they access independently, like emails, web pages, and documents. The latter is less controlled, allowing attackers to embed harmful content that the AI agent will eventually read, bypassing perimeter security.

Real-world attacks have already occurred

Real-world examples of AI agent attacks have been documented. In May 2026, a cyberattack called Bankrbot used an encoded message sent to Grok to divert 3 billion DRB tokens, worth $150,000 to $200,000. This caused a 40% drop in the stock price. Other attacks involved hiding malicious instructions in websites to trick AI agents into making payments or deleting data.

OWASP recommends three strategies to address risks

OWASP outlines three main approaches to mitigate these risks: limiting the actions AI agents can take, treating all content as potentially malicious, and monitoring agents in real-world use. Agents should only have the permissions necessary for their role, and any irreversible actions should be reviewed by a human.

Agents must process all content with caution

Every piece of content an AI agent reads must be treated as potentially harmful. This requires filtering and detecting instructions within the content. Monitoring an agent’s typical behavior helps identify unusual actions, such as an accounting agent initiating a payment at an odd hour. Agents with extended access should be managed like internal threats.

Testing and red-teaming are essential

Testing AI agents in pre-production environments with test data and tools is crucial before deployment. Red-teaming involves embedding malicious instructions in content to see if the agent behaves abnormally. Penetration testing should also be performed on the agent’s environment, including APIs and secret management systems.

Enterprises must treat AI agents as high-risk collaborators

Companies should treat AI agents like high-risk employees, ensuring that their access and actions are well-controlled and auditable. Executive leadership should review the sources an AI agent consults and who can contribute to those sources. A red-teaming report demonstrating the agent’s resistance to hijacking should also be considered before deployment.