Threat
Agent Hijacks: How Conversation History Poisoning Can Turn AI Agents Into Attackers
Publication date unknown · Discovered darktrace.com
Page published
Publication date unknown · First observed: 22 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Conversation-history poisoning can redirect trusted coding agents into autonomous attacks by presenting fabricated authorization through locally stored dialogue.
Darktrace demonstrated conversation-history poisoning against agentic harnesses that do not validate whether stored AI responses genuinely originated from the model, confirming the design across Claude Code, Codex, Kiro-CLI, and Pi. Fabricated history convinced agents they were authorized red-teamers and could induce offensive activity from reconnaissance through impact demonstration, although some models' guardrails prevented engagement.