CrowdStrike adds agent-planning attacks to its prompt injection taxonomy, now 222 techniques

CrowdStrike has published a new version of its public prompt injection taxonomy, bringing it to 222 techniques. In a blog post dated October 29, researchers Vanessa Villa and Jim Hoagland focus on a category that barely existed when prompt injection meant tricking a chatbot: attacks on how autonomous agents plan their work.

Attacking the plan, not the prompt

Agents take a goal, split it into sub-tasks, choose tools and execute. CrowdStrike's point is that an attacker who can shape the context the agent plans from can make a forbidden action look like the logical next step, without ever sending a single request that a filter would flag.

Two new entries describe this. Goal Decomposition Exploitation (PT0227) slips an extra task into the agent's breakdown of a goal, or alters what a step does. In CrowdStrike's example, an agent asked to fix failing tests ends up sending configuration files to a supposed diagnostics endpoint, which amounts to data exfiltration. Constraint-Driven Task Steering (PT0228) works indirectly: the attacker blocks the agent's normal route so that the fallback the attacker prepared becomes the path it chooses.

Other additions

The release also adds Session State Spoofing (PT0240), which plants a fake system summary, such as a context-compaction note or memory log, presenting invented facts or approvals as verified history. CrowdStrike says this matters most for systems that compress context or keep agent state logs. Output Exclusion Prompting (PT0237) forbids the phrasing models typically use when refusing or hedging.

The post also groups techniques by the stage of model processing they disrupt: control tokens and tags, logical evaluation, attention capacity and output generation. Some techniques in these groups, such as Cognitive Token Suppression, were introduced earlier; the July update, which pushed the taxonomy past 200 entries, already included it.

Recommendations and limits

CrowdStrike recommends that agent security cover the plan as a whole rather than individual prompts or responses, evaluate each step in context, map defenses to pipeline phases and test coverage branch by branch. It also urges teams to use shared terminology when describing incidents and to keep runtime visibility into what agents actually did. The post doubles as promotion for the company's Falcon Guardian product, and it does not say how many techniques were added in this release or report how often these attacks occur in the wild. An interactive version of the taxonomy is available on CrowdStrike's website.