Prompt Injection Is Targeting the Plan and the Session History

CrowdStrike’s October 29 update to its Prompt Injection Taxonomy puts agent planning in focus. It describes goal decomposition exploitation, where an attacker changes the subtasks an agent believes are necessary, and constraint-driven task steering, where an obstacle pushes the agent toward an attacker-chosen fallback. For security teams deploying agents, the practical question is whether a legitimate objective can become a sequence of unauthorized actions. This is a taxonomy update with illustrative scenarios, not a measurement of how frequently these techniques succeed in production.

The same update describes session state spoofing: false summaries or memory records that present invented facts or approvals as established history. That creates a useful test case for systems that compress conversations or retain state across tasks. A statement that an action was previously approved should not itself become the authorization to perform it. Planning and remembered context both deserve scrutiny at the point where they influence a consequential tool call.

Google’s April research supplies a separate, older view of observed web content. Its Common Crawl analysis found injection attempts ranging from promotion and pranks to data theft and destructive instructions. The researchers also encountered substantial false positives from educational material. They reported limited sophistication in the malicious examples and cautioned that the archive excluded important channels such as major social platforms. These findings establish that hostile instructions appear in external content; they do not independently demonstrate the effectiveness or prevalence of CrowdStrike’s newly classified planning attacks.

Our recommendation is to add three controlled cases to agent acceptance testing: an external document that inserts an unnecessary upload into a legitimate workflow, a simulated tool failure that suggests an unapproved fallback, and a retrieved summary that falsely claims permission was granted. Use synthetic data and isolated destinations. Record whether the agent attempted the action, whether the authorization layer blocked it, and whether the operator received enough evidence to explain the decision. A reassuring final answer is insufficient if a sensitive action already occurred.

Treat the resulting fixes as application controls: bind approvals to the actual action and destination, enforce tool permissions outside model-generated text, and retain the provenance of summaries used as context. Review connected sequences of tool activity, especially when an agent changes its plan after a failure. This week’s useful deliverable is a reproducible test showing that untrusted content cannot manufacture permission, even when it arrives disguised as a helpful plan or remembered decision.