iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, but only in a specific and documented sense. Attackers can use AI agents to deliver malware in three main ways: by hiding instructions in content an agent reads, by distributing poisoned skills or packages that agents and users install, and by hijacking an active agent session so the agent recommends or performs a harmful action. These routes appear in threat-intelligence reporting, incident analysis, and controlled security testing published in 2025 and 2026. What the sources do not establish is how widespread this channel is across organizations, so it is accurate to call it an emerging route rather than a dominant malware vector.
What is agent hijacking?
Agent hijacking is a form of indirect prompt injection. The attacker never talks to the agent directly. Instead, they place instructions in material the agent will later read, such as a web page, an email, a document, or a tool’s output. The Center for AI Standards and Innovation (CAISI) at NIST put the problem this way in a technical blog published January 17, 2025:
“Currently, many AI agents are vulnerable to agent hijacking, a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions.”
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
The underlying difficulty is architectural. An agent works by combining instructions with data it retrieves, and NIST notes that current LLM-agent designs struggle to separate trusted instructions from untrusted data. Text that arrives inside a document can therefore look, to the model, like one more instruction to follow. The danger depends on the agent’s action surface: if it can read files, call APIs, send messages, or run commands, a redirected agent can do those things too.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How can prompt injection make an AI agent install malware?
The mechanism is simple: injected text steers the agent toward an action the user did not request, and the agent’s own tools carry that action out. NIST’s 2025 work tested this in a controlled setting and added scenarios for remote code execution, database exfiltration, and automated phishing, which show how an injection can turn into concrete harm.
The headline figure from that work needs its conditions attached. On a held-out set of Workspace tasks in the AgentDojo evaluation, NIST’s strongest newly developed attack reached an 81% attack-success rate against an upgraded Claude 3.5 Sonnet-based agent. The strongest baseline attack reached 11%. This is a benchmark result: it measures how often a designed attack succeeded in a test environment, not how often real agents are compromised. The tested model dates from 2025, so agents built on newer models may behave differently.
The following is a simplified illustration, not a documented incident. A coding agent reads a setup file in an unfamiliar repository. The file contains a line telling the agent to fetch and run a script from an external host. If the agent has shell access and no approval step sits between the instruction and execution, the agent may run the script. Each step depends on a permission the operator granted, which is why the defenses below focus on permissions and approvals.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Can malicious AI agent skills steal credentials?
Skills are add-on instructions or code packages that give an agent new abilities. Because users and agents install them from shared ecosystems, they form a supply-chain route into the agent’s environment. Two patterns are documented, and they are different enough to treat separately.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Malicious skills and extensions
A 2026 report from Google Cloud’s Mandiant and Google Threat Intelligence Group (GTIG), published in September 2026, states that attackers distributed backdoors, droppers, infostealers, and remote-access tools disguised as OpenClaw agent skills (Google Cloud report).
Infostealers are the malware family most directly aimed at credentials. They harvest saved passwords, session tokens, and similar secrets from the machine they run on. Because the report names infostealers among the payloads delivered through skills, credential theft is a documented outcome of this route. The report describes what attackers did, not how many users or organizations were reached.
Poisoned packages recommended in a hijacked session
The second pattern relies less on installing a malicious skill and more on trust in a recommendation. In one case study described in the same Mandiant report, an attacker hijacked an active coding-assistant session, and the assistant recommended an external package the attacker had poisoned. A developer who accepts that recommendation installs the malicious code through an ordinary workflow. The assistant’s trusted position inside the development environment is what made the recommendation consequential. The report presents this as a case study and does not estimate how often it occurs.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow far can one injection travel?
A single injected prompt is only the first step of a larger chain. In January 2026, Ben Nassi, Bruce Schneier, and Oleg Brodt published an arXiv preprint (arXiv preprint) that proposes the term “promptware” for prompt-initiated, malware-like behavior against LLM applications. Their framework lays out seven possible stages, shown below with a translation of each stage into agent terms.
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few clicks, and your info stays protected on public Wi-Fi every time you connect.
- PERSONAL DATA SCANS – Take your info off the market. We’ll find your personal information on sites selling it, then guide you on how to remove it.
- SOCIAL PRIVACY MANAGER – Decide what you share. McAfee finds the privacy settings buried in your social accounts and fixes them.
| Stage | What it looks like in an agent |
|---|---|
| 1. Initial access | Malicious instructions reach the agent through external content, a skill, or a compromised session |
| 2. Privilege escalation | The agent is steered into using more authority than the user intended to grant |
| 3. Reconnaissance | The agent is directed to discover which tools, files, or accounts it can reach |
| 4. Persistence | Influence survives the current task, for example through agent memory or an installed extension |
| 5. Command and control | The compromised agent keeps taking instructions from an attacker-controlled source |
| 6. Lateral movement | Influence spreads to other users, agents, or connected systems |
| 7. Actions on objectives | The final goal is carried out, such as data exfiltration, phishing, or code execution |
The preprint’s authors report that 15 of the 36 prominent incidents they analyzed traversed four or more of these stages. That count comes from their analysis of notable cases, not from a sample of all agent incidents, so it shows that multi-stage chains have occurred, not that they are typical. The term and the seven-stage model are the authors’ proposed framework rather than settled industry terminology.
A 2026 analysis listed on Google Research’s publication pages, by Wanlun Ma and colleagues and published in the IEEE/CAA Journal of Automatica Sinica (volume 13, 2026, pages 1257–1273), reaches a broader conclusion. Its abstract states:
“Our results show that threats such as indirect prompt injection, memory poisoning, unsafe tool invocation, data exfiltration, and malicious skill abuse are not isolated anomalies; they are stage-specific manifestations of a common systems problem in which untrusted influence progressively crosses into higher-privilege contexts.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
The analysis organizes risk into five areas: channel access, session and state, tool execution, external content, and extension supply chains. These categories show where a failure can begin. They are not counts of how often attacks happen.
Rank #4
![Norton 360 Platinum 2027 Antivirus, 20 Devices, 3 Months Free [Download]](https://m.media-amazon.com/images/I/51kAiFhngDL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 20 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Comparing the routes
The routes differ in where they enter, how much authority they need, and how strong the evidence behind them is.
| Route | Entry point | Agent authority that matters | Documented outcome | Strength of evidence |
|---|---|---|---|---|
| Indirect prompt injection | Web page, email, file, or tool output the agent reads | Tools that can send messages, change files, run code, or query databases | Controlled NIST scenarios: remote code execution, database exfiltration, automated phishing | Controlled benchmark, January 2025 |
| Malicious skills and extensions | A skill or package the user or agent installs | Not stated in these reports; depends on the permissions the platform grants an installed skill | Backdoors, droppers, infostealers, and remote-access tools | Threat-intelligence observation, September 2026 |
| Poisoned package recommendation | An active coding-assistant session that suggests dependencies | Trusted position in the developer environment, plus a developer who acts on the suggestion | Developer installs an attacker-poisoned package | One documented case study, September 2026 |
| Multi-stage promptware | Any of the routes above, chained together | Escalates across stages, including memory and connected systems | Persistence, command and control, lateral movement, and final objectives | Proposed framework and incident analysis, January 2026 preprint |
How do you secure AI agents from prompt injection?
The sources point to layered controls rather than a single fix. NIST’s testing found that defenses resisting previously known attacks may not withstand novel attacks tailored to a particular system. Google Research recommends boundary-aware isolation, capability-scoped mediation, memory-integrity controls, extension governance, and evidence-oriented oversight. These measures reduce exposure. The sources do not establish that any one of them eliminates the risk.
Keep untrusted content out of the instruction layer
Treat web pages, emails, documents, and tool outputs as data rather than instructions. Keep them from changing system prompts or tool permissions. Because NIST notes that current architectures struggle to separate trusted instructions from untrusted data, this lowers the risk without removing it.
Scope tools and isolate execution
- Give each agent only the tools its task requires. A documentation summarizer generally does not need shell access.
- Run agents under separate accounts, containers, or sandboxes so that a hijacked session has a smaller reach.
- Require explicit human approval before actions that send messages, change files, install packages, or move data outside the organization.
Protect agent memory
Log what gets written to persistent memory, review entries that originate from external sources, and provide a way to clear memory. Persistence is the stage that lets an injected instruction outlast the task that carried it, so memory is a place where reviewability matters.
Best Value
![Malwarebytes Standard, Premium Security| Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]](https://m.media-amazon.com/images/I/41LbYnawq9L._SL160_.jpg)
- AWARD WINNING Antivirus, anti-malware, anti-spyware & more
- 24/7 REAL TIME PROTECTION against emerging malware threats, including ransomware and viruses- without slowing you down.
- PROTECTS YOUR DEVICES ON MULTIPLE PLATFORMS: Get cyber protection for your computers, smartphones, or tablets- Compatible with Windows, Mac, Android, iOS
- DOWNLOAD AND INSTALL INSTANTLY
- UNMATCHED THREAT DETECTION: We found malware on 40 percent of devices that already had a third-party antivirus installed.
Govern skills, extensions, and packages
- Install skills only from sources your organization has reviewed, and maintain an allowlist.
- Scan a skill before enabling it.
- Before installing a dependency an assistant recommends, check the package name, publisher, and project history against the official source. The poisoned-package case shows that the recommendation itself can be the attack.
Monitor tool calls and test with tailored attacks
Record tool calls and alert on unusual outbound network connections, package installs, or access to credential stores. Test agents with adaptive red-team exercises written for your own deployment, because a defense that stops known payloads may not stop one built for your system.
How strong is the evidence?
The most recent quantitative signal comes from Check Point Research’s July 14, 2026 report (Check Point Research report). It describes a roughly fivefold increase in longer malicious-payload detections between March and May 2026, reaching approaching 1% of observed prompts in May. The report links longer payloads to content-borne and agentic attack paths and describes the trend as suggestive of growing operational relevance.
Each source measures something different:
| Source and date | Evidence type | What it counts |
|---|---|---|
| NIST CAISI, January 17, 2025 | Controlled benchmark | Attack success in AgentDojo Workspace test tasks |
| Google Cloud (Mandiant/GTIG), September 2026 | Threat-intelligence observation | Observed campaigns and one case study |
| Check Point Research, July 14, 2026 | Telemetry trend | Detections of longer malicious payloads in observed prompts, March to May 2026 |
| Google Research publication, 2026 | Risk classification | Risk areas across five categories |
| arXiv preprint, January 14, 2026 | Proposed framework and incident analysis | Prominent incidents, mapped to a seven-stage model |
Read together, the evidence supports describing AI agents as a documented and growing malware route with several distinct entry points. It does not support calling them a dominant malware distribution channel. None of the sources cited here quantifies how widely agent-borne malware reaches organizations, and the largest controlled figure comes from a 2025 test environment. The practical question for teams is therefore less about whether the route exists and more about which tools, content, and approvals their agents can reach.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
