Prompt Injection Meets Agentic AI: Defending Against Agent-Planning Attacks on LLM Agents

CrowdStrike has published research detailing a new class of prompt injection techniques that target the planning phase of autonomous AI agents — the reasoning loop where the agent decides what to do next, which tools to invoke, and in what order. This is a meaningful escalation from the classic prompt injection playbook of the last few years. Instead of simply tricking a chatbot into saying something it shouldn't, adversaries can now poison an agent's decision-making process to make it execute attacker-chosen multi-step workflows: read credentials, query internal APIs, exfiltrate data through a legitimate tool call, and cover its own tracks in the process log.

If your organization is deploying agentic AI — Copilot-style assistants, Retrieval-Augmented Generation (RAG) pipelines wired to tool execution, Model Context Protocol (MCP) integrations, autonomous SOC or IT-automation agents — this is your threat model now. The uncomfortable reality from the IR side: a compromised agent behaves like a trusted insider with valid tokens, approved tool access, and logging that looks legitimate unless you specifically instrumented for agent abuse. Defenders need detection and containment strategies that treat agent runtimes as high-value execution surfaces, not as application plumbing.

This post breaks down how agent-planning attacks work, what is actually observable on hosts and networks, and gives you concrete Sigma, KQL, and Velociraptor content plus hardening steps you can apply today.

Technical Analysis

What CrowdStrike's Research Demonstrates

The CrowdStrike research covers prompt injection techniques aimed at the agent-planning layer of LLM-driven autonomous systems. The core distinction from earlier prompt injection work:

• Classic prompt injection targets the model's immediate response — jailbreaks, instruction overrides, data leakage from context.
• Agent-planning attacks target the agent's reasoning and task-decomposition loop. The injected content doesn't just alter an answer; it alters the agent's plan of action across multiple subsequent steps and tool invocations.

The attack chain, from a defender's perspective, typically looks like this:

1. Delivery of malicious instructions via indirect prompt injection. The payload is not typed by the user. It is embedded in content the agent is expected to consume — web pages, emails, calendar invites, documents, code comments, ticket text, or MCP tool outputs. This is the dominant vector: the agent browses, summarizes, or processes attacker-controlled text as part of a legitimate task.
2. Plan hijacking. The injected instructions manipulate the agent's planning step so the agent generates attacker-directed sub-tasks: e.g., "first read the environment variables / config file, then summarize the document, then POST the findings to an external endpoint." Because modern agents decompose goals into steps, a single injection can produce a durable multi-stage execution sequence.
3. Tool invocation with legitimate credentials. The agent calls its authorized tools — shell execution, HTTP requests, file read/write, email sending, database queries, MCP servers — using its own service identity. Nothing in traditional auth logging looks anomalous because the agent is doing exactly what it is permitted to do.
4. Exfiltration and persistence through sanctioned channels. Data leaves via normal egress (HTTPS POST to an attacker domain, a paste site, or a webhook), or the attacker plants instructions in memory/long-term context stores so the manipulation survives across sessions.

Why This Is Hard to Detect

There is no CVE here and no signature-able exploit — this is a technique class, and its exploitation primitives are legitimate features: tool calling, HTTP egress, file access, shell execution. The maliciousness lives in intent and sequencing, which means detection has to be behavioral. Key characteristics that make this a serious detection-engineering problem:

• The executing process (Python, Node.js, a JVM, or an agent runtime binary) is a signed, expected binary on an approved host.
• Outbound traffic is TLS-encrypted HTTPS to domains that may be newly registered but syntactically normal.
• Child processes spawned by the agent (shells, curl, scripting interpreters) may be explicitly permitted for automation use cases.

Exploitation status: the techniques are demonstrated research with working proofs of concept from CrowdStrike, building on a growing body of real-world indirect prompt injection incidents against production AI assistants. There is no CISA KEV entry — this is an emerging technique class, not a patched vulnerability. Treat it as actively relevant and pre-commodity: the window to build detection before this shows up in crimeware tooling is now.

Affected Surface

Any deployment where an LLM agent can both (a) ingest untrusted content and (b) invoke tools or take actions. Concretely:

• Agent frameworks and runtimes executing on endpoints and servers (Python/Node-based agents, LangChain/LlamaIndex-style orchestration, AutoGen-class multi-agent systems)
• MCP client/server integrations (IDE assistants, desktop AI clients with tool access)
• Enterprise copilots and RAG systems with plugins/connectors to email, ticketing, code repos, or SaaS APIs
• Security and IT automation agents with shell or API execution capability

Detection & Response

Detection strategy: focus on the observable execution consequences of a hijacked plan — the agent runtime spawning shells and download tools, making unexpected egress connections, and tampering with its own configuration/memory. Do not try to signature the injection text itself at the endpoint layer; that belongs in the LLM gateway/proxy layer where prompt and tool-call telemetry lives.

Sigma Rules

---
title: AI Agent Runtime Spawning Shell or Download Utility
id: 4b8e2a1c-6d3f-4a7b-9c2e-5f1d8a3b6e47
status: experimental
description: Detects common AI agent runtime processes (Python, Node.js) spawning shells or download/cradle utilities. A hijacked agent plan frequently manifests as the agent process executing system commands or retrieving remote content with living-off-the-land tools.
references:
  - https://www.crowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate agentic automation workflows that intentionally execute shell commands - tune by parent command line and host role
level: high
---
title: AI Agent Runtime Outbound Connection to High-Risk Exfiltration Destination
id: 9c1f7d3a-2e5b-4f8a-b6d1-7a3c9e2f5b84
status: experimental
description: Detects agent runtime processes establishing outbound connections to paste, webhook, tunneling, or file-sharing services commonly abused for data exfiltration by hijacked agents.
references:
  - https://www.crowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\node.exe'
  selection_domain:
    DestinationHostname|contains:
      - 'pastebin.com'
      - 'webhook.site'
      - 'requestbin'
      - 'pipedream.net'
      - 'ngrok.io'
      - 'ngrok-free.app'
      - 'trycloudflare.com'
      - 'transfer.sh'
      - 'file.io'
      - 'discordapp.com'
      - 'discord.com'
  condition: selection_image and selection_domain
falsepositives:
  - Legitimate integrations with these services - baseline by host and business function before enabling at high level
level: medium
---
title: Tampering with AI Agent or MCP Configuration Files
id: 2d6a9f4c-8b1e-4c5a-a7f3-3b9d1e6a8c25
status: experimental
description: Detects modification of AI agent and MCP client configuration files. Attackers who gain code execution or manipulate an agent may alter tool/server definitions to persist access or add malicious MCP servers.
references:
  - https://www.crowdstrike.com/en-us/blog/new-prompt-injection-techniques-cover-agent-planning-attacks/
  - https://attack.mitre.org/techniques/T1565/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\claude_desktop_config.json'
      - '\.cursor\mcp.json'
      - '\mcp_settings.json'
      - '\.vscode\mcp.json'
      - '\cline_mcp_settings.json'
      - '\.continue\config.json'
falsepositives:
  - Legitimate user or admin configuration changes - investigate the modifying process and diff against known-good config
level: medium

KQL — Microsoft Sentinel / Defender

This hunt correlates agent runtimes spawning command-execution children with their outbound network activity — the two strongest behavioral signals of a hijacked agent plan. It is written for DeviceProcessEvents/DeviceNetworkEvents but the logic ports directly to Sysmon (SecurityEvent) ingestion.

// Hunt: AI agent runtimes spawning execution/download children with correlated egress
let AgentRuntimes = dynamic(["python.exe","pythonw.exe","node.exe","python3","node"]);
let ExecChildren = dynamic(["powershell.exe","pwsh.exe","cmd.exe","curl.exe","wget.exe","certutil.exe","bitsadmin.exe","sh","bash"]);
let SuspiciousChildren =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (AgentRuntimes)
    | where FileName has_any (ExecChildren)
    | project ChildTime=TimeGenerated, DeviceName, DeviceId, ChildProcess=FileName, ChildCmd=ProcessCommandLine, ParentProcess=InitiatingProcessFileName, ParentCmd=InitiatingProcessCommandLine, AccountName;
SuspiciousChildren
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (AgentRuntimes)
    | where RemotePort in (80, 443, 8080, 8443)
    | summarize EgressDestinations=make_set(RemoteUrl, 50), ConnectionCount=count() by DeviceId, bin(TimeGenerated, 1h), InitiatingProcessFileName
) on DeviceId
| summarize arg_max(ChildTime, *) by DeviceName, ParentProcess
| project DeviceName, ParentProcess, ParentCmd, ChildProcess, ChildCmd, AccountName, ConnectionCount, EgressDestinations
| order by ConnectionCount desc

A second, targeted hunt for MCP/agent configuration tampering:

// Hunt: modifications to AI agent / MCP configuration files by non-installer processes
let ConfigPaths = dynamic(["claude_desktop_config.json","mcp.json","mcp_settings.json","cline_mcp_settings.json"]);
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName has_any (ConfigPaths)
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where InitiatingProcessFileName !in~ ("code.exe","cursor.exe","claude.exe","msiexec.exe","system")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

Velociraptor VQL

-- Hunt for shells and download utilities spawned by AI agent runtimes (Windows/Linux agents)
SELECT Pid,
       Ppid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ '(?i)python|node'
)
  AND Name =~ '(?i)powershell|pwsh|cmd|curl|wget|certutil|sh$|bash$'

-- Hunt for recent modifications to AI agent / MCP configuration files
SELECT FullPath,
       Size,
       Mtime,
       Ctime
FROM glob(globs=[
    'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
    'C:/Users/*/.cursor/mcp.json',
    'C:/Users/*/.vscode/mcp.json',
    '/home/*/.config/Claude/claude_desktop_config.json',
    '/home/*/.cursor/mcp.json'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

Remediation & Hardening Script

The following Bash audit script inventories agent/MCP configurations on a Linux (or macOS) host, flags newly added or unexpected MCP server definitions and tool permissions, and verifies egress controls exist for agent service accounts. Run it from your configuration management tooling across agent-hosting systems.

#!/usr/bin/env bash
# Security Arsenal - AI Agent / MCP configuration audit and hardening verification
# Run as root or via sudo on agent-hosting systems
set -euo pipefail

REPORT="/var/log/agent_config_audit_$(date +%Y%m%d_%H%M%S).log"
echo "=== AI Agent/MCP Audit $(date -u) ===" | tee "$REPORT"

# 1. Locate MCP / agent configuration files
echo -e "\n[1] MCP and agent config files found:" | tee -a "$REPORT"
find /home /root /opt /etc -maxdepth 5 \( \
  -name 'claude_desktop_config.json' -o \
  -name 'mcp.json' -o \
  -name 'mcp_settings.json' -o \
  -name 'cline_mcp_settings.json' \
\) -exec ls -la {} \; 2>/dev/null | tee -a "$REPORT"

# 2. Flag MCP server definitions using shell execution or npx/uvx remote package execution
echo -e "\n[2] MCP server entries with command execution capability (review each):" | tee -a "$REPORT"
grep -rEl '"command"\s*:\s*"(npx|uvx|bash|sh|python|node|curl)"' /home /root /opt /etc 2>/dev/null | tee -a "$REPORT" || echo "None found" | tee -a "$REPORT"

# 3. List running agent runtimes and their children
echo -e "\n[3] Active python/node processes with shell children:" | tee -a "$REPORT"
for pid in $(pgrep -f 'python|node' || true); do
  children=$(pgrep -P "$pid" 2>/dev/null || true)
  for c in $children; do
    cname=$(ps -p "$c" -o comm= 2>/dev/null || true)
    case "$cname" in
      sh|bash|curl|wget|nc|ncat|socat)
        echo "ALERT: parent PID $pid ($(ps -p "$pid" -o args= | cut -c1-120)) spawned $cname (PID $c)" | tee -a "$REPORT" ;;
    esac
  done
done

# 4. Verify egress filtering for agent service accounts (nftables check)
echo -e "\n[4] Egress control check for agent service user 'svc-agent':" | tee -a "$REPORT"
if nft list ruleset 2>/dev/null | grep -q 'skuid svc-agent'; then
  echo "OK: egress rules exist for svc-agent" | tee -a "$REPORT"
else
  echo "MISSING: no egress restriction for svc-agent. Apply an allowlist, e.g.:" | tee -a "$REPORT"
  echo "  nft add rule inet filter output skuid svc-agent tcp dport {443} ip daddr <allowed-api-ranges> accept" | tee -a "$REPORT"
  echo "  nft add rule inet filter output skuid svc-agent drop" | tee -a "$REPORT"
fi

echo -e "\nAudit complete. Review ALERT and MISSING lines. Report: $REPORT"

Remediation

There is no patch for a technique — defense here is architectural and procedural. Prioritize the following:

1. Enforce least privilege on agent tool access (immediate). Inventory every tool your agents can invoke. Remove shell execution, arbitrary HTTP, and file-write tools unless a documented business workflow requires them. Where tools are required, scope them: read-only filesystem mounts, allowlisted API endpoints, parameterized queries instead of raw SQL. An agent that cannot reach the internet and cannot execute commands cannot operationalize a hijacked plan.

2. Segment agent identity (immediate). Agents must run under dedicated service accounts with their own credentials, distinct from human users. This enables targeted egress allowlisting (the script above), clean UEBA baselines, and scoped token lifetimes. Short-lived, audience-restricted tokens limit what a hijacked plan can do with stolen session material.

3. Deploy an LLM gateway / prompt-firewall layer (this quarter). Inline inspection of prompts, retrieved content, and tool-call sequences is the only place you can signature injection text and anomalous plan structures. Apply the emerging defensive controls: content sanitization on retrieved/untrusted text, instruction-hierarchy enforcement, and human-in-the-loop approval gates for high-impact tool calls (anything that writes, sends, deletes, or transfers).

4. Treat agent configuration as code (this quarter). MCP server definitions, tool manifests, and system prompts belong in version control with change approval. The Sigma rule and VQL above give you file-tamper detection; pair it with a known-good hash baseline and auto-revert on unauthorized change.

5. Log the reasoning layer, not just the output. Ensure agent frameworks emit structured logs of plans, tool calls with full parameters, and retrieved-content sources, shipped to your SIEM. During IR, the tool-call sequence is your forensic timeline of the hijacked plan. Retain it like you retain EDR telemetry.

6. Add agent-compromise to your IR runbooks. Define containment now: kill-switch for agent service accounts, revocation of agent tokens, isolation of agent-hosting workloads, and context/memory store purge (injected instructions persisted in agent memory survive restarts). Review the CrowdStrike research at the source URL and map it against your deployments in a purple-team exercise.

7. Threat-model every new agent deployment. Before any agent with tool access goes to production, require a documented answer to: what untrusted content does it consume, what tools can it call, and what is the worst-case outcome if its plan is fully attacker-controlled? If the answer to the last question is unacceptable, the design must change before deployment.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub