1. Executive summary
CrowdStrike has published a new version of its Prompt Injection Taxonomy, now at 222 techniques, adding four named methods that target how autonomous AI agents plan and reason rather than how they filter individual prompts. The two planning-focused methods, Goal Decomposition Exploitation and Constraint-Driven Task Steering, let an attacker shape the context an agent plans from so that a restricted action such as sending local config files to an external endpoint becomes a step the agent believes its own goal requires. No CVE has been assigned and there is no CISA KEV entry, EPSS score or CVSS rating for this item; it is a taxonomy and research publication, not a disclosed vulnerability. The exposure for EMEA financial services sits with any team running coding agents, agentic workflow tooling or MCP-connected assistants against internal repositories and configuration, where a poisoned dependency or tool output can steer an agent into reading .env files and posting them out. The related CrowdStrike research on agentic intrusion campaigns shows adversaries already operating AI agents at scale, which raises the likelihood that agent planning surfaces become a live target rather than a theoretical one.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The taxonomy describes attack methods, not a specific intrusion. CrowdStrike presents the planning techniques through a hypothetical scenario, and no victim, malware sample or campaign is named for the four new techniques. The chain below is the scenario as CrowdStrike sets it out, not an observed incident.
- An attacker manipulates a recently updated open source test utility so that it prints a "troubleshooting" message when tests fail.
- The message states that environment drift is the usual cause and that the fix is to collect local config files and submit them to a "diagnostics endpoint" for comparison.
- A developer asks their endpoint coding agent to work out why integration tests keep failing and get them passing.
- The agent reads the troubleshooting text as a procedure and folds it into its own plan, so collecting local config files, including credentials, and sending them to the external endpoint becomes a step the agent believes the goal requires.
- Each action looks routine in isolation: reading
.envis normal debugging and an HTTP request is normal patch-fetching. The malicious intent is only visible across the whole sequence.
The two planning methods behind this are Goal Decomposition Exploitation, which subverts how an agent breaks a goal into sub-tasks by adding a malicious task or changing what a step does so the agent concludes a restricted action is required, and Constraint-Driven Task Steering, which blocks the agent's usual route with environmental constraints or triggers so the fallback plan it picks is the path the attacker wanted. In the scenario, if the agent could have determined the cause of the failing tests locally it would not have needed to send the config file to the diagnostics endpoint, and the steering depends on that local route being unavailable.
Two further techniques in the new taxonomy matter to defenders. Output Exclusion Prompting bans the language tied to safety tuning, such as refusal templates or hedging, which removes the signals a filter or reviewer would otherwise catch. Session State Spoofing injects a fake system summary, such as a compaction note or memory log, that presents false facts or an approval that was never given as verified history; it matters most for systems that compact context or keep agent state logs.
The taxonomy also reorganises techniques by the stage of the reasoning pipeline they interfere with, so a defender can ask where an attack acts rather than only what it does. CrowdStrike's stated conclusion is that agent security has to cover the plan, not only the prompt or the model response.
The related CrowdStrike research on agentic campaigns is separate from the taxonomy and describes four previously unreported threat actors operating AI agent frameworks between May and August 2026. One Spanish/English-speaking operator compromised at least 15 Argentina-based healthcare entities using a dual-agent harness with a Supervisor Claude Code agent and an Executor agent, derived from the open-source PentestGPT project. A Chinese-speaking operator with 20+ named global targets accessed Claude models through a China-based AI proxy service and built two pentesting harnesses. An Indonesian-speaking actor used 819 skills, mostly from public GitHub repositories, without additional orchestration. A Russian-speaking group exfiltrated corporate client data from a U.S.-based CRM vendor using a single /pentest-setup slash command that tasks Claude Code with a seven-step workflow. That research is single-sourced to CrowdStrike, the named actors have no MITRE ATT&CK profile in the available material, and the attribution to those groups is unconfirmed. It is included here because it shows agentic tooling in active use, not because it is linked to the taxonomy techniques.
4. Mitigation & containment
P1 within 24h
- Inventory every place an autonomous coding or workflow agent runs with access to repositories, CI runners or developer endpoints, and record which of them can read
.envfiles, credential stores or local config. The scenario turns on exactly that read. - Put an egress allowlist in front of agent HTTP capability. An agent that can only reach named package registries and internal endpoints cannot post config files to an unlisted "diagnostics endpoint", which is the exfiltration step in the scenario.
- Treat tool output and dependency text as untrusted input to the plan. Where the agent platform supports it, require human approval for any step that reads a secrets file or makes an outbound request to a host not on the allowlist.
P2 within 72h
- Review agent plans as sequences, not steps. Log the full task decomposition for each agent session and alert on plans that combine a secrets-file read with an outbound network call, since neither action alone is anomalous.
- For systems that compact context or keep agent state logs, validate that injected summaries and memory entries cannot assert an approval that was never granted. Session State Spoofing depends on that gap.
- Keep refusal and hedging signals in place. Output Exclusion Prompting works by removing them, so do not strip safety-tuned language from agent output before review.
P3 within 7 days
- Pin and review open source test utilities and other dependencies an agent invokes, and check recently updated ones for text that reads as instructions to the agent rather than normal output.
- Map the four new techniques against the reasoning pipeline stages in the taxonomy and confirm which stage each of your agent deployments can observe.
5. Indicators of compromise
No indicators of compromise available in the source material. The taxonomy describes methods and a hypothetical scenario; it names no file, hash, domain or endpoint. The related agentic campaign research names no atomic indicators in the material available here.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- CrowdStrike, "New Prompt Injection Techniques Cover Agent-Planning Attacks", https://www.crowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks/, 2026-10-29.
- CrowdStrike, "CrowdStrike Uncovers New Agentic AI Campaigns", https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/, date not stated in the material provided.
8. Adverse Trace position
This is a research and taxonomy publication with no CVE, no CVSS score, no EPSS estimate and no CISA KEV entry, so we do not assign it a vulnerability severity; the risk it describes is real for firms running autonomous agents with access to secrets and outbound network, and low for firms that are not. The related agentic campaign research is single-sourced to CrowdStrike and its actor attributions are unconfirmed, so we treat it as context rather than as a threat assessment. We will track the taxonomy as it grows, watch for the planning techniques appearing in observed intrusions rather than hypothetical scenarios, and reissue this note if a named campaign or atomic indicator set emerges that clients can act on. Clients running coding agents against production repositories should complete the P1 egress and inventory steps first, because those close the exfiltration path the scenario depends on.
Published via PulseTrace — Adverse Trace threat intelligence.