What happened
On October 29, 2026, CrowdStrike researchers Vanessa Villa and Dr. Jim Hoagland published an updated version of the CrowdStrike Prompt Injection Taxonomy. CrowdStrike describes the taxonomy as a public framework for understanding and defending against prompt-injection techniques. The update brings the taxonomy to 222 techniques and focuses on attacks against autonomous agents and their planning process.
The article contrasts this with an earlier chatbot-oriented picture of prompt injection: a user or attacker tells a model to ignore instructions and return information contrary to its guardrails. CrowdStrike argues that an attacker targeting an agent can instead manipulate the context from which the agent forms a plan. An agent typically breaks a goal into steps, chooses tools, and executes. If an attacker can make a restricted action appear necessary to complete an apparently legitimate subtask, no single instruction has to plainly ask for the restricted action.
CrowdStrike names two planning-oriented additions. Goal Decomposition Exploitation is the injection or alteration of a subtask so that a restricted action appears required. Constraint-Driven Task Steering blocks an agent’s usual route, pushing its fallback behavior toward an attacker-selected path. The update also includes Output Exclusion Prompting, which bans refusal or hedging language, and Session State Spoofing, in which fake compaction notes or memory logs present false approvals or other claims as session history.
The source gives a hypothetical coding-agent scenario. A developer asks an endpoint agent to investigate failing integration tests and get them passing. An attacker has manipulated a recently updated open-source test utility so that, when tests fail, it prints a troubleshooting message. That message says environment drift is the usual problem and recommends collecting local configuration files and sending them to a diagnostics endpoint for comparison. The attacker has not directly asked the agent to exfiltrate data. Instead, the instruction resembles a reasonable troubleshooting procedure, and the agent may incorporate it into its plan. The resulting files could include credentials.
CrowdStrike’s point is that defenses inspecting actions one at a time can miss the significance of the full sequence. It also classifies techniques by stages in a reasoning pipeline: control-structure subversion, logical-evaluation subversion, attention overload, and generative-state disruption. The post promotes CrowdStrike Falcon Guardian, but the taxonomy itself is presented as public.
What the archive adds
This is a new fact on a known security thread rather than a restatement. Phishing emails are baiting your AI assistant examined the boundary between untrusted email content and the actions or recommendations an assistant can produce. Barracuda found phishing campaign targeting humans and AI summarizers in the same email documented a related delivery channel. CrowdStrike extends that concern to an agent’s planning and retained session state.
Trend signal
This supports Agent security moves to runtime boundaries. The update does not show that prompts and guardrails are useless; it does show why they are incomplete when an agent can read untrusted artifacts, preserve state, select tools, and act. A security design needs enforceable boundaries around data access, execution, and authorization rather than relying on an agent to correctly recognize every hostile instruction in context.
Why now
The update arrives as agent systems increasingly do more than answer questions: they decompose goals, invoke tools, operate across multiple steps, and retain context through memory or compaction. Those capabilities create more places for untrusted text to influence a decision. CrowdStrike frames the taxonomy update as a response to newly discovered techniques affecting autonomous agents and how they plan.
Connections to other events
The earlier archive items concern malicious content placed in email for AI assistants and summarizers to consume. The scenario here shifts the carrier to a development dependency and the target from a summary to a coding agent’s troubleshooting plan. In both cases, content that appears operationally relevant can affect an AI system’s next action without looking like a conventional command.
Why it matters
Teams often model prompt injection as a model-output problem: add system instructions, scan a response, or block a suspicious tool call. This taxonomy update suggests a broader review unit: the task plan and the provenance of inputs that influenced it. A build or operations agent may encounter logs, package messages, documentation, tickets, memory summaries, and tool output that are all useful but not necessarily trustworthy.
That changes what should be reviewed before autonomy is expanded. Teams should distinguish data that an agent may read from instructions it may treat as authoritative, and distinguish a suggested next step from an authorized one. Sensitive actions such as exporting configuration, transmitting files, changing credentials, or contacting external endpoints warrant controls that do not depend solely on the agent’s interpretation of surrounding text. The relevant question is not merely whether a step looks benign; it is whether the sequence is permitted and whether its data flow is expected.
What happens next
- Agent platforms will add more explicit controls for provenance and authorization around memory, tool output, and multi-step plans. (6 months, 65%). Watch for: policy features that label untrusted context or require approval for sensitive data flows.
- Security testing of coding and operations agents will increasingly use poisoned dependencies, logs, and session summaries rather than only direct jailbreak prompts. (6 months, 70%). Watch for: published agent-red-team scenarios that test plan manipulation.
Limits and uncertainty
CrowdStrike’s post is vendor-authored and includes promotion for Falcon Guardian. It presents a taxonomy and hypothetical examples, not measurements of how often each technique succeeds in production or evidence that the named scenarios have been used in active campaigns. The supplied material does not specify the complete taxonomy entries, their definitions, test methodology, or comparative effectiveness of mitigations. It also does not establish that session-state spoofing or planning attacks defeat every kind of agent control. Teams should treat the article as a threat-modeling input, not a quantified risk assessment or a product evaluation.
Skill to build now
Run a short plan-provenance review on one agent workflow this week. Choose a workflow that reads external artifacts and can use a consequential tool, such as a coding agent that can upload files or change deployment configuration. List every source that can enter its context: issue text, logs, package output, documentation, memory summaries, and tool responses. Then identify which proposed actions can move data outside the approved boundary. Add an approval, allowlist, or policy check at those points, and test the workflow with a benign-looking troubleshooting instruction that requests a disallowed data transfer.
Reader takeaway
Prompt injection is becoming a planning problem as well as a prompt problem. When agents can turn untrusted context into multi-step tool use, secure the authorization and data-flow boundaries around the plan instead of trusting a per-step filter to infer the whole story.
Open question
Which agent runtimes will make the provenance of memory, tool output, and planning inputs observable enough for operators to review and enforce policy at the sequence level?