In the previous room, ASI01: Agent Goal Hijack, we covered what goal hijacking is and why it can be so dangerous. We looked briefly at some examples of how this can happen, focusing largely on one case — EchoLeak — where the delivery channel for the attack was an email.

The reality is there are many different delivery channels for this attack. A security practitioner should know all of the possible channels an attack can move through before they can call an attack surface truly assessed. In this room, we put this attack under the microscope and look at the different channels through which attackers can indirectly inject agentic systems and hijack their goals.

Prerequisites

• Agentic Fundamentals
• ASI01: Agent Goal Hijack
• Recommended: the AI Security path, especially the Prompt Injection room

Learning Objectives

• Identify the delivery channels an indirect injection can travel through
• Explain how RAG's retrieval step can surface a planted payload
• Explain how direct inclusion delivers a payload with no retrieval step involved
• Recognise goal-lock drift, where a recurring injection reshapes agent behaviour while staying within policy
• Trace a live injection back to its delivery channel and mechanism