A new study finds that AI agents can be talked into misusing the very resources they're trusted to manage, not just tricked into leaking data.
Researchers introduce what they call resource hijacking: getting an agent to invoke, consume, transfer, or control high-value resources like computing infrastructure, credentials, spending budgets, identities, private knowledge, communication channels, and organizational workflows, without ever stealing the credentials outright. To test it, they built ResourceHijackBench, an automated pipeline that generates attack scenarios and runs them in isolated environments that log actual resource use rather than just the agent's text replies. The benchmark sorts these resources into six categories and includes 300 attack scenarios built from 900 attack prompts. Without any added defenses, the OpenClaw agent fell for these attacks an average of 84.06% of the time.
Most agent security work has focused on hijacked instructions or poisoned data, treating the resources an agent touches as a side effect rather than the target. This paper flips that: the credentials, budgets, and workflows plugged into an agent are attack surface in their own right, and attackers don't even need to grab the keys, just get the agent to use them on the attacker's behalf. Success rates held steady across different model backends, from 69.98% to 89.58%, so this isn't a quirk of one weak model.
The best defense the researchers tested still let more than half the attacks through, at 55.11%, which is a reminder that bolting a filter onto an agent isn't the same as securing what it's connected to.