Google DeepMind just published what amounts to a field guide for breaking AI agents. The paper, titled “AI Agent Traps,” lays out six distinct categories of adversarial attacks that can compromise autonomous AI systems, and the success rates are the kind of numbers that should make anyone deploying these tools lose a little sleep.

Released as an SSRN preprint, the research represents the first systematic attempt to classify the ways bad actors can manipulate AI agents operating in real-world environments.

The six flavors of AI sabotage

The taxonomy breaks down into six attack categories: Content Injection Traps, semantic manipulation, cognitive state and memory poisoning, behavioral control, systemic and multi-agent attacks, and human-in-the-loop traps. Each targets a different stage of an AI agent’s operational cycle, from how it perceives information to how it reasons, remembers, and ultimately acts.

Content Injection Traps are perhaps the most straightforward and alarming. Environments like websites can embed harmful content that AI agents process without realizing they’ve been compromised. The techniques include hidden HTML comments, white-on-white text that’s invisible to human eyes but readable by machines, steganography, and manipulated image pixels.

Hidden prompt injections, one flavor of content injection, commandeered AI agents in testing with an 86% success rate. Sub-agent hijacking, where attackers take control of subordinate AI systems within a larger framework, landed between 58% and 90% effectiveness.

Semantic manipulation targets the reasoning layer. Rather than injecting hidden commands, these attacks twist the meaning of legitimate content to lead agents toward incorrect conclusions or harmful actions.

Memory poisoning goes deeper still. AI agents increasingly maintain persistent memory across sessions to improve their performance. Attackers who can corrupt that memory don’t just compromise a single interaction. They potentially alter every future decision the agent makes.

Behavioral control attacks manipulate the agent’s action-selection mechanisms. Systemic and multi-agent attacks exploit the interactions between multiple AI systems working together. And human-in-the-loop traps specifically target the moments when AI agents hand off decisions to human operators, exploiting the trust boundaries between machine and person.

Why this matters beyond the lab

The research team, which includes Matija Franklin, Nenad Tomasev, Julian Jacobs, Joel Z. Leibo, and Simon Osindero, frames the problem around a simple reality: AI agents are rapidly gaining access to web browsing, email, and transaction capabilities. Every new capability is also a new attack surface.

When an AI agent has the ability to send emails, make purchases, or execute code, a successful attack isn’t just an awkward screenshot on social media. It’s a potential financial loss, data breach, or worse.

Prompt injection has been a known vulnerability since large language models started interacting with external data. But the DeepMind taxonomy elevates the conversation from individual exploits to a structured framework that covers the full spectrum of threats.

What this means for investors and the AI industry

AI agents are increasingly being integrated into decentralized finance protocols, trading systems, and blockchain-based applications. An AI agent managing a DeFi portfolio that gets hijacked through a content injection attack isn’t a theoretical concern anymore. It’s a quantified risk with an 86% success rate in controlled conditions.

As enterprises digest the implications of attacks with 58% to 90% success rates against sub-agents, demand for defensive tooling, red-teaming services, and hardened agent frameworks should increase.