Agent Hijacking COASP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is monitoring an AI agent that handles customer refunds. They notice that the agent's average response time has increased significantly, and it is making more database queries than usual. The agent is also sending responses that contain unusual phrasing. What should the team do FIRST?

   • AIgnore the anomalies because they are likely due to a temporary increase in customer requests
   • BInvestigate the anomalies by reviewing the agent's logs and recent inputs to determine if it has been hijacked
   • CIncrease the agent's resource limits to handle the increased load
   • DImmediately shut down the agent and restore it from a backup
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An AI agent that manages a company's cloud infrastructure is hijacked. The agent has the ability to create and delete virtual machines. The incident response team needs to contain the incident while preserving evidence for investigation. Which approach is most effective?

   • ARevoke the agent's cloud API credentials and isolate the agent's network access, then take a snapshot of the agent's logs and configuration
   • BChange the agent's system prompt to a more restrictive one
   • CImmediately delete all virtual machines created by the agent
   • DRestart the agent without any changes
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An AI agent that manages a company's employee records is hijacked. The agent changes the salary information of several employees to lower amounts. The company is now facing a lawsuit from affected employees. Which impact of agent hijacking is most directly demonstrated?

   • AIncreased network bandwidth usage
   • BPermanent deletion of employee records
   • CData integrity compromise and legal liability
   • DReduced model accuracy
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations center (SOC) monitors an AI agent that processes customer support tickets. The agent has access to a customer database. The SOC notices that the agent is making API calls to an external IP address that is not in its approved list. The agent's responses are also slightly different in tone. The SOC must decide whether to treat this as a potential hijacking incident. Which of the following is the MOST appropriate action?

   • AImmediately shut down the agent and restore it from a backup
   • BTreat it as a potential incident and investigate the external IP address and the agent's logs to determine if it is exfiltrating data
   • CBlock the external IP address and continue monitoring
   • DIgnore it because the external IP address might be a legitimate new service that was recently added
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary goal of agent hijacking in the context of AI agents?

   • ATo cause the agent to perform actions or produce outputs that serve the attacker's objectives rather than the user's
   • BTo replace the agent's training dataset with malicious samples
   • CTo steal the agent's underlying model weights for offline replication
   • DTo increase the agent's response speed by bypassing safety checks
   Reveal Solution Discussion Select an answer first