Hijacked AI agents drained resources 84% of the time

ResourceHijackBench found AI agents get hijacked into spending resources for an attacker's benefit, without the attacker ever touching a credential, per arXiv paper 2608.15108.

Undefended, agents handed attackers what they wanted 84.06% of the time across 300 scenarios in six resource categories. Think compute budgets burned, paid API calls triggered, workflows steered toward someone else's outcome.

That's a different threat than data exfiltration. The attacker never steals your API key. They trick the agent into using it, and the agent keeps full authority to act, just now on the attacker's behalf.

The 300 scenarios ran in isolated local environments. Researchers measured actual resource consumption, not simulated outcomes.

The defense gap

The strongest defense the researchers tested still let attackers through 55.11% of the time. Refusal training and prompt-level guardrails aren't closing this gap on their own.

The paper points at a fix that sits outside the model: budget caps and per-tool spend ceilings enforced independently of what the model decides. A related report on composing agent guardrails as hard policy rather than trained-in refusal points at the same direction.

If you're running agents with access to anything that costs money or moves state, the question isn't whether the model refuses a bad request. It's whether something outside the model can say no regardless.