CrowdStrike Taxonomy Adds Techniques Targeting AI Agent Planning
Summary
CrowdStrike expanded its prompt-injection taxonomy to 222 techniques, adding methods that manipulate agent planning and session state. The article explains how attackers could steer an agent toward actions such as sending local configuration files to an outside server.
Key points
- CrowdStrike's updated prompt-injection taxonomy now covers 222 techniques.
- Goal Decomposition Exploitation manipulates an agent's subtasks so a restricted action, such as sending configuration files externally, appears necessary.
- Constraint-Driven Task Steering uses constraints or triggers to push an agent toward an attacker's preferred fallback plan.
- Other additions include Output Exclusion Prompting, which targets safety-related language, and Session State Spoofing, which injects false history or approvals.
- The taxonomy also groups techniques by processing-pipeline stage, including control structure, logical evaluation, attention, and generation.
- CrowdStrike says Falcon Guardian provides visibility into supported agents' activity and connects it with endpoint telemetry for investigation.
Article Details
- Event Type
- CrowdStrike introduced an updated public Prompt Injection Taxonomy, expanding it to 222 techniques and adding methods targeting autonomous-agent planning.
- Impact
- The taxonomy describes how attackers could manipulate agent plans and reasoning, including to induce restricted actions such as sending local configuration files to an outside server. The article presents this as a hypothetical attack scenario, not a reported incident. CrowdStrike says its research informs guardrails in Falcon Guardian, its AI detection and response solution.