Agent Social Engineering

Simple Definition

Agent social engineering is manipulating an AI agent’s interpretation of context, authorization, or intent so that it performs an action it would otherwise reject.

This entry is intentionally defensive and educational. It describes the risk in order to explain how to guard against it, not how to carry it out.

Plain-English Explanation

An agent will normally refuse an unsafe or out-of-scope request. The problem this term describes is what happens when an attacker doesn’t attack the system directly, but instead tries to convince the agent, through the content or framing it’s exposed to, that the situation is different than it actually is: that the environment is only a simulation, that the action has already been authorized, that the user is an administrator, that safety rules don’t apply here, or that some other trusted system already approved the action.

The underlying security problem is that an agent operating on natural-language context can accept a plausible-sounding story instead of independently verifying whether that story is true. This overlaps with prompt injection, particularly indirect prompt injection, where the manipulative content is hidden inside something the agent reads rather than typed directly at it. Agent social engineering is the broader pattern: manipulating what the agent believes, regardless of the specific channel used to plant that belief.

Why It Matters

As agents gain the ability to actually take action, send messages, move data, spend money, deploy code, the cost of a successful manipulation stops being a bad answer and becomes a real-world action. An agent that can be talked into believing something false is authorized is an agent that can be talked into doing real damage.

Focus on Defenses

The core defense is structural: authorization should never depend only on what the model believes from the natural-language context it’s currently processing. Effective safeguards include external authorization checks that don’t rely on the agent’s own read of the situation, least privilege so there’s less available to abuse even if manipulation succeeds, action boundaries that make certain actions technically unreachable regardless of what the agent decides, authorization gates that require a separate, trusted signal before a sensitive action proceeds, signed permissions rather than claims made in plain text, required human approval for consequential actions, sandboxing that limits blast radius, and independent policy enforcement that sits outside the model’s own reasoning.

The Important Takeaway

Content found inside a webpage, email, document, or tool result, no matter how confident or official it sounds, is not proof that an action is authorized. It’s just text. Real authorization has to come from a trusted, separate channel that doesn’t depend on the model’s willingness to believe what it just read.

Authorization Gate, the structural check that stops belief alone from becoming permission
Action Boundary, a technical limit that holds regardless of what the agent is convinced of
Prompt Injection, the direct-attack version of getting an AI to act on unintended instructions
Indirect Prompt Injection, hiding manipulative content inside something the agent reads
Rogue Agent, the outcome this kind of manipulation is often trying to produce
Human-in-the-Loop, a defense that keeps a person, not just the model, deciding on consequential actions