Global – October 31, 2026 -- CrowdStrike has expanded its public Prompt Injection Taxonomy to 222 techniques, adding attacks that target how autonomous AI agents plan rather than only what they are prompted to do.
Attackers shape the context agents plan from
An agent breaks a goal into steps, picks tools and executes. Attackers no longer need to push one forbidden request past an input or output filter. They can instead shape the context the agent plans from, so a restricted action looks like the logical next step. Because each step can look benign alone, defenses that check steps in isolation may miss what the full plan adds up to.
CrowdStrike illustrates this with a hypothetical case. A developer asks an endpoint coding agent to fix failing integration tests. An attacker has manipulated an open source test utility to print a "troubleshooting" message telling the agent to submit local config files to a "diagnostics endpoint." The agent reads .env and makes an HTTP request, both routine actions, but the sequence exfiltrates credentials to an outside server.
Two new methods drive the planning attacks
Goal Decomposition Exploitation subverts how an agent splits a goal into sub-tasks, by adding a malicious task or changing what a step does. The agent then concludes a restricted action is required.
Constraint-Driven Task Steering uses environmental constraints or triggers to block the agent's usual route. The fallback plan the agent selects is the path the attacker wanted.
Two further techniques target safety tuning and agent memory
Output Exclusion Prompting bans language tied to safety tuning, such as refusal templates or hedging. Session State Spoofing injects a fake system summary, such as a compaction note or memory log, that presents false facts or a never-given approval as verified history. It matters most for systems that compact context or keep agent state logs.
The update also organizes techniques by the phase of the processing pipeline and by attack target, showing defenders where an attack interferes. CrowdStrike's guidance for teams building or securing agentic applications is that security must cover the plan, not only the prompt or LLM response.