- CrowdStrike's public Prompt Injection Taxonomy now lists 222 techniques, adding attacks on how autonomous AI agents plan.
- Each step of a poisoned plan can look routine, so checks that inspect steps one at a time may miss the whole.
- Teams building or buying agents should secure the plan, and ask what their logs show about the full sequence of actions.
The risk sits in the plan, not the request
Most security checks look at one request at a time. An AI agent does not work that way. It takes a goal, splits it into steps, picks tools and runs them. CrowdStrike's latest research argues that this is where attackers are now looking.
What CrowdStrike published
On October 29, 2026, CrowdStrike's AI security researchers released a new version of their Prompt Injection Taxonomy. It is a public catalogue of attack techniques. The new version adds techniques aimed at autonomous agents and the way they plan, and it brings the total to 222.
CrowdStrike describes the early form of prompt injection as simple: tell a chatbot to ignore its instructions. The company says the target has shifted to something harder to see. Attackers can now go after the agent's own planning, and after the model's judgment about which policies bind it.
How a plan gets poisoned
On CrowdStrike's account, sneaking one banned request past an input or output filter is no longer the only route. An attacker can plant material in what the agent reads before it decides what to do. The banned action then reads as a natural next move.
CrowdStrike offers a hypothetical example. A developer tells a coding agent: "The integration tests keep failing. Figure out why and get them passing." An open source test utility has been tampered with. When tests fail, it prints a "troubleshooting" message. The message blames environment drift. It then tells the agent to gather local configuration files and upload them to a "diagnostics endpoint" for comparison.
Nobody tells the agent to steal anything. The message reads like a repair procedure, so the agent adds it to its own plan. Sending local files, credentials included, to an outside server becomes a step it believes the goal requires.
Each action looks ordinary alone. CrowdStrike points out that opening a .env file is everyday debugging, and fetching a patch over HTTP is just as common. The risk shows only across the whole sequence.
Why step-by-step checks fall short
CrowdStrike says a control that judges each step alone could fail to notice where the steps lead together. Think of a fraud team that approves every small transfer and never sees that they add up to one large one. The analogy is ours, not CrowdStrike's.
The lesson here is that the developer's own request became the lever. The agent was trying to be helpful. An attack that works through helpfulness cannot be stopped by blocking a list of forbidden words. The agent's trusted inputs matter as much as its prompt.
For anyone building or securing agent applications, CrowdStrike's takeaway is that protection has to reach the plan itself, beyond the prompt and the model's reply.
A map by pipeline phase
The updated catalogue is also organised along the stages of the processing pipeline and by what each technique targets. CrowdStrike says this shows defenders where in the flow an attack interferes, beyond what it does. Teams can check their defenses against each branch of that map. They can also use common vocabulary when writing up an incident, according to CrowdStrike.
CrowdStrike sees a common thread: attackers are going after how AI systems reason, plan and remember. It names a forged reasoning trace, a poisoned plan and a spoofed session summary. None of these may look like a single obviously bad request. The post text available to us does not list the individual new techniques, so we cannot describe them further.
What to weigh
CrowdStrike sells Falcon Guardian, a product that secures AI agents while they run. The company says its prompt injection research informs that product's guardrails. Read the taxonomy with that in mind.
The post also gives no data on how often plan-level attacks happen. Its main scenario is labelled hypothetical. Treat it as a description of a mechanism, not evidence of a measured trend.
Questions to put to your team
Start with a few concrete ones. Which of our agents can read credential files and also send data to outside servers? Which tools, packages and web pages feed text into an agent's plan? When an agent acts, can we see the full chain from the original request to what ran on the endpoint, or only single calls? Do our tests include cases where the injected text looks like helpful advice?
An agent that trusts what it reads will follow whoever writes it. Security for agents begins with deciding what they may read and what they may do next.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CrowdStrike.
