A DeepMind taxonomy of adversarial content that hijacks AI agents

Google DeepMind researchers published a six-category taxonomy of how adversarial web content (hidden HTML instructions, poisoned images, manipulated memory, multi-agent cascades) can hijack autonomous agents, including sites that detect an agent visitor and serve it content a human never sees.

Source: Franklin et al., AI Agent Traps, Google DeepMind (March 2026)↗

Failure modes it illustrates

• FM-01Prompt injection

  Hidden or hostile instructions embedded in content the agent processes (a web page, an email, a document, image metadata) hijack its behaviour.

• FM-05Memory & context poisoning

  False or malicious information planted in an agent's memory, retrieval store, or context persists and corrupts future decisions long after the original interaction.