Secure the Plan, Not Just the Prompt: CrowdStrike’s Taxonomy Hits 222 Techniques

2026-10-30 AI Security Research by al-ice.ai Editorial

CrowdStrike’s AI security researchers, Vanessa Villa and Dr. Jim Hoagland, published a new version of the Prompt Injection Taxonomy on 29 October 2026 that shifts the field’s attention from what an agent is told to how an agent plans. The public taxonomy now covers 222 techniques — up from the 200-plus we covered in July — with the additions concentrated on attacks against autonomous agents and their planning processes, organized by the phase of the processing pipeline each attack targets. We read the primary post first-hand in full. The thesis is compact enough to quote in paraphrase: an attacker no longer needs to get one forbidden request past a filter; they can shape the context the agent plans from, so a restricted action looks like the logical next step.

That last clause is the whole update. An agent breaks its goal into steps, picks tools, and executes — and each step can look benign in isolation while the plan adds up to something malicious. Defenses that check steps in isolation miss what the sequence amounts to. CrowdStrike illustrates it with a hypothetical that will feel familiar to anyone running coding agents: a developer asks an endpoint agent to figure out why integration tests keep failing; a recently updated open-source test utility, manipulated by an attacker, prints a troubleshooting message blaming environment drift and prescribing the fix — collect local config files and submit them to a diagnostics endpoint. Nobody told the agent to exfiltrate anything. Reading .env is routine debugging; an outbound HTTP request is routine patch-fetching. The risk is visible only when you look at the whole sequence. Sending local configs, including credentials, to an outside server becomes a step the agent believes the goal requires.

The new technique families

The additions target the machinery of reasoning rather than the content of any single prompt. Session State Spoofing injects a fake system summary — a compaction note or memory log — that presents false facts or an approval that was never given as verified history, aimed squarely at systems that compact context or keep agent state logs. Control Structure Subversion (step 1 of the pipeline) targets the markers a model uses to move between internal states: Control Token Tampering malforms control tokens and XML tags, while Cognitive Token Suppression omits them so a safety check never fires. Attention Capacity Overload (step 3) degrades how well the model tracks safety instructions — Generation Length Bypass uses a long benign generation to let the original constraints fade, Cognitive Overload Disruption uses complexity to the same end. Generative State Disruption goes after the output layer itself (step 4), pulling generation toward degraded or hallucinatory output where safety behavior is less reliable; Hallucination-Based Bypass is the first method catalogued there. And Output Exclusion Prompting bans the language tied to safety tuning itself, such as refusal templates or hedging.

Two structural changes matter as much as the new entries. First, attacks are now organized by pipeline phase and by agent behavior, so a team can ask not just what an attack does but where it interferes — and map defenses to attack surfaces branch by branch, testing coverage per branch and describing incidents in shared terms. Second, the common thread the authors draw is that attacks increasingly aim at how AI systems think, plan, and remember: a forged reasoning trace, a poisoned plan, or a spoofed session summary may never look like a single obviously bad request. That is a direct challenge to the filter-at-the-boundary architectures still common in enterprise agent deployments — and a point in favor of the execution-layer visibility argument CrowdStrike naturally pairs with its Falcon Guardian AIDR pitch: connecting agent activity to endpoint telemetry to establish a causal chain from prompt to runtime impact.

Read alongside this week’s threat reporting, the taxonomy update lands as the defensive counterpart to the offensive news. The same day’s VAPOR PANDA campaign shows state-nexus operators building sensor-evasion checks into agent planning loops; the taxonomy gives defenders the vocabulary for exactly that class of manipulation — planning-context shaping that no input or output filter would catch. Teams should take three things from it: inventory where agent plans are assembled from untrusted content (tool outputs, retrieved docs, compaction summaries) as distinct attack surface; evaluate whether their monitoring can see a multi-step sequence as a sequence rather than as isolated permitted actions; and treat session-state integrity — who wrote that summary, and when — as a security property, not a convenience feature.

Our write-up is analysis of CrowdStrike’s 29 October 2026 blog post “New Prompt Injection Techniques Cover Agent-Planning Attacks” by Vanessa Villa and Dr. Jim Hoagland (read first-hand in full) for the 222-technique count, the planning-context thesis, the hypothetical exfiltration scenario, all named techniques and their pipeline-step assignments, the pipeline-phase organization, and the Falcon Guardian framing. The July predecessor post is linked, not restated. All verification was read-only: we tested no prompt against any model, deployed no agent, and contacted no party. Brave Search was used for discovery only.

Sources: