Agent Hijacking COASP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational corporation's AI agent handles internal expense reports and has access to the financial system. The agent is designed to approve expenses under $500 automatically. An attacker sends a crafted expense report that includes a hidden instruction in the 'memo' field, causing the agent to approve a $50,000 expense. The agent's normal approval logic is overridden. The security team must decide between two mitigations: (1) adding a rule that requires manual review for any expense over $1,000, or (2) implementing input sanitization that strips HTML and special characters from the memo field. Which mitigation is MORE effective, and why?

   • ABoth are equally effective because they address the same vulnerability
   • BInput sanitization is more effective because it prevents the injection from occurring in the first place
   • CManual review for expenses over $1,000 is more effective because it provides a human check on the agent's decisions, regardless of the injection vector
   • DNeither is effective because the agent will always be vulnerable to prompt injection
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After an AI agent is confirmed hijacked, the incident response team needs to recover the system. Which step is most appropriate for recovery?

   • AChange the agent's system prompt to a more complex one
   • BDelete all logs from the incident to protect user privacy
   • CContinue using the agent while monitoring for further issues
   • DRestore the agent's configuration and knowledge base from a known-good backup taken before the incident
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A logistics company's AI agent optimizes delivery routes and has access to the map database. The agent is hijacked to reroute all deliveries to a single warehouse, causing delays. The security team is considering two mitigations: (1) implementing input sanitization that strips HTML and special characters from all inputs, and (2) implementing a rule that requires a human to approve any route change that affects more than 10% of deliveries. Which mitigation is MORE effective, and why?

   • AInput sanitization is more effective because it prevents the injection from occurring in the first place
   • BBoth are equally effective because they both prevent the attack
   • CNeither is effective because the agent will always be vulnerable to prompt injection
   • DHuman approval for large route changes is more effective because it provides a human check on the agent's decisions, regardless of the injection vector
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident response for a hijacked AI agent, the team needs to investigate the root cause. Which action is most appropriate?

   • AChange the agent's system prompt and hope the issue resolves
   • BPreserve all logs and inputs that the agent processed before and during the incident
   • CImmediately delete all logs to prevent data leakage
   • DRestart the agent without collecting any data
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization's AI agent schedules patient appointments and accesses a patient database. An attacker poisons the training data used to fine-tune the agent, causing it to occasionally book appointments with a fake provider name. The agent's behavior appears normal in testing but fails in production. Which attack vector does this scenario describe, and what is the PRIMARY consequence?

   • APrompt injection; the consequence is unauthorized access to patient records
   • BData poisoning; the consequence is corrupted data integrity in the scheduling system
   • CModel inversion; the consequence is leakage of patient personal data
   • DMalicious tool use; the consequence is a denial of service on the scheduling service
   Reveal Solution Discussion Select an answer first