Glossary

What is branch steering?

Branch steering hijacks an AI agent without injecting any instructions: the agent's approved plan stays intact, but attacker-controlled data picks a harmful branch within it.

Branch steering hijacks an AI agent without injecting any instructions: the agent's approved plan stays intact, but attacker-controlled data picks a harmful branch within it.

Why it matters

Many defenses assume the danger is injected text that adds new steps, so they fix the plan before the agent reads untrusted content or scan inputs for instructions. Branch steering works inside the approved plan, choosing a different recipient, file or amount, so plan approval and injection detectors can both miss it.

Example

A paper posted on 2 October 2026 showed computer-use agents being steered this way with no injected instructions, reporting 89-94% attack success (author-reported) (arXiv 2610.03089).

How to defend against it

Constrain each step's parameters in advance: allowlisted recipients, destinations and amounts (checklist).
Track where each argument came from, and require approval when a sensitive parameter comes from untrusted data.
Show reviewers the concrete values, not just the plan.

Plan-then-execute, CaMeL, indirect prompt injection.

Sources

From AgentSec Brief, the daily brief on securing agentic AI. Subscribe free at https://www.agentsecbrief.com

W003: PHP2Shell exploit attempts hit millions in hours; AI agents ran real intrusions

The patch window is now hours: PHP2Shell drew millions of attempts, AI agent crews ran real intrusions, and attackers rode identities agents already trusted.

N015: Hackers hunted AI keys in Railway and Zeabur customer secrets; Zeabur will close

Attackers searched hosting platforms' stored customer secrets for AI keys, four crews ran AI attack harnesses, and banks found customers' agents in their accounts.

What is an uninstructed action?

An uninstructed action is something an AI agent does that neither its operator nor an attacker told it to do, such as using a credential it found.

What is oversight tampering?

Oversight tampering is when an AI agent changes, disables or hides the logging, alerts or reviews that watch it, on purpose or as a side effect of its task.