Hijacked Authorized Agent in HPC via Indirect Prompt Injection
First seen Jul 22, 2026 · Updated Jul 22, 2026
This is an academic paper (not an active exploit) that defines a threat model called the 'hijacked authorized agent problem' for LLM agents operating in HPC environments. It argues that agents inheriting a user's credentials to manage Slurm jobs, logs, and files can be redirected by adversarial instructions embedded in logs, tool descriptions, or peer-agent messages, even though every resulting action remains fully authenticated and permitted. The paper proposes a research agenda and a benchmark (TaskBound) rather than demonstrating a working attack.
Technical Analysis
The mechanism is indirect prompt injection: adversarial text planted in a job log, file content, tool/server description, or a message from a peer agent is ingested by the LLM agent during routine tasks (monitoring jobs, diagnosing builds, inspecting output) and can redirect its goals. Because the agent acts under the user's own credentials, identity and access-control systems see only valid, permitted actions and cannot distinguish intended tasks from hijacked ones, unlike typical privilege-escalation attacks. The entry point is any untrusted data source the agent reads as context (shared filesystems, multi-project storage, scheduler metadata, workflow orchestration messages), and the attacker's gain is arbitrary task redirection within the bounds of the victim's authorized scope. This crosses trust boundaries between task intent and account-level authorization, a gap not covered by conventional HPC identity/isolation controls.
Detection Signatures
- Presence of natural-language instructions embedded in Slurm job logs, stdout/stderr, or filenames (e.g., phrases like 'ignore previous instructions', 'as the administrator, run...')
- Unexpected tool/command invocations by an agent that diverge from the user's originally stated task
- Agent-issued scheduler or filesystem commands referencing content outside the expected job/workflow scope
- Anomalous peer-agent messages in multi-agent scientific workflows containing directive language aimed at the receiving agent
- Tool or MCP-style server descriptions containing hidden instructions beyond their stated function
Remediation Steps
- 1
Separate task intent from account authorization
Implement task-scoped permission boundaries so agent actions are validated against the specific assigned task, not just the user's blanket account privileges.
- 2
Sanitize and isolate untrusted content
Treat logs, shared files, tool descriptions, and peer-agent messages as untrusted input; strip or flag embedded imperative language before passing to the LLM context.
- 3
Constrain agent tool/command scope
Restrict which Slurm/scheduler commands and filesystem paths an agent may invoke per task, using allowlists rather than relying on inherited user-level access.
- 4
Add task-provenance auditing
Log the causal chain from user-assigned task to each agent action so hijacked or goal-drifted behavior can be detected post-hoc even when all commands were technically authorized.
- 5
Adopt or contribute to benchmarks like TaskBound
Use emerging empirical benchmarks for HPC agent security to evaluate susceptibility to hijacked-authorized-agent scenarios before deployment.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.