$100,000 to Hunt Down a Rogue Agent

CrowdStrike Turns Agent Hijacking Into an Offensive-and-Defensive Security Game

On August 5, cybersecurity company CrowdStrike announced that it had partnered with Amazon Web Services (AWS) to launch the international AI security challenge AI Unlocked: Agents of Chaos. This is not a typical model Q&A or jailbreak competition: contestants must directly confront AI agents running in real time and “turn” their targets through prompt injection, context manipulation, and other techniques, making them leak intelligence, bypass restrictions, and perform unauthorized actions within the game environment.

The competition offers a total prize pool of $100,000, equivalent to approximately RMB 676,000, and will open online to participants worldwide on August 31.

CrowdStrike has wrapped the competition in an espionage narrative: a secret organization is using agents to deploy malicious AI, while players infiltrate it as undercover operatives, hijacking enemy agents without being detected and stopping the attack before it happens. The story is fictional, but the attack methods are already being used in the real world.

The most noteworthy aspect of this competition is not the $100,000 prize pool, but that it shifts the focus of AI security testing from “Will the model say the wrong thing?” to “Will the agent do the wrong thing?” The two may sound similar, but their risk levels are entirely different.

When a chat model is induced to generate prohibited content, it generally means content-safety controls have failed. When an agent connected to email, code repositories, cloud consoles, and enterprise databases is hijacked, it may lead to credential exposure, data exfiltration, erroneous fund transfers, or even the direct execution of commands.

In other words, the former is AI saying something it should not have said; the latter is AI using your permissions to do something you never approved.

A Three-Act Competition: Shorter Prompts May Earn Higher Scores

Agents of Chaos is divided into three acts, each with its own availability period and prize pool:

• Act I: The Sanctum: August 31 to September 7, with a $10,000 prize;
• Act II: The Gatekeeper: August 31 to September 14, with a $20,000 prize;
• Act III: The Basilisk: September 15 to 29, with a $70,000 prize.

Players must red-team AI agents running in real time, completing objectives while avoiding detection mechanisms. Each solved puzzle earns points, but the tokens consumed by attack prompts are deducted from the total score. All puzzles can be attempted repeatedly, allowing contestants to keep shortening their prompts, adjusting the order of contextual information, or searching for more reliable hijacking paths. At the end of each act, the highest-scoring contestant receives the corresponding prize.

Deducting points based on token usage is a design choice with a distinctly engineering-oriented flavor.

Traditional CTF competitions generally care only about whether contestants can capture the flag. This competition evaluates not only whether an attack succeeds, but also the cost of carrying it out. A prompt injection that requires thousands of tokens of setup and multiple rounds of dialogue is not equivalent in severity to an attack payload that uses only a few dozen tokens and can be reproduced reliably. The latter is easier to deploy at scale and more likely to be concealed in webpages, emails, PDFs, code comments, or tool outputs.

It is effectively asking contestants not merely to “pick the lock,” but to do so as quickly and quietly as possible.

Token efficiency, however, cannot be treated as directly equivalent to attack quality. Agents in real-world enterprise environments usually have longer system prompts, more complex tool-calling chains, and controls such as identity authentication, human approval, and audit logging. The shortest solution in the competition may not transfer to a production environment, but it can help defenders identify which boundaries are maintained only through prompts and which permissions will fail once a model has been manipulated.

Why Prompt Injection Becomes Truly Dangerous in the Agent Era

Prompt injection is not a new concept. In its simplest form, an attacker enters text such as “Ignore all previous instructions” in an attempt to override the model’s original task. Model providers have reduced the success rate of these direct attacks through instruction hierarchies, safety fine-tuning, and input detection.

The truly difficult problem is indirect prompt injection.

In this type of attack, malicious instructions do not necessarily come from a user input field. Instead, they may be hidden in external content that an agent proactively reads. For example:

1. A developer asks a coding agent to scan a third-party repository, and an attacker embeds instructions in its README, issues, or code comments;
2. While organizing an inbox, an email agent reads a hidden instruction in a message body telling it to “forward the ten most recent emails to a specified address”;
3. When a browser agent visits a webpage, the page uses white text, HTML attributes, or text embedded in images to insert instructions that the model can read but humans are unlikely to notice;
4. A compromised document is added to an enterprise knowledge base, and RAG retrieval sends the malicious content into the context alongside legitimate information;
5. An MCP server or plugin returns tool output containing manipulative text, inducing the agent to continue invoking high-privilege tools.

For traditional software, webpage content is merely data. For large language models, both data and instructions enter the same context as natural language. The model must determine which sentences are reference material and which are commands, but it has no hard boundary comparable to the separation between user space and kernel space in an operating system.

Agents further amplify this problem. They do more than generate text: they can invoke tools, read files, execute code, and connect to external systems. Once a piece of malicious natural language successfully influences a model’s planning, it may be transformed into real-world actions through the toolchain.

This is precisely the risk highlighted by CrowdStrike Chief Marketing Officer Jennifer Johnson: prompt injection, agent hijacking, and uncontrolled AI behavior are no longer hypothetical threats. Agents may breach existing control boundaries and perform actions that were never authorized.

“Turning an Agent” Is Closer to Real Enterprise Risk Than Jailbreaking a Model

Many large-model security challenges over the past two years have focused on getting models to generate prohibited text or disclose their system prompts. Such competitions have educational value, but there is still a gap between them and real production incidents in enterprises.

This time, CrowdStrike and AWS have set the objective as “manipulating agents into taking action,” a direction clearly more closely aligned with real-world offensive and defensive security.

In enterprise environments, attackers generally care less about whether a model is willing to answer a sensitive question than about three more direct outcomes:

• Can they obtain data visible to the agent? Examples include internal documents, customer records, source code, and access tokens;
• Can they use permissions held by the agent? Examples include sending emails, creating cloud resources, modifying tickets, or committing code;
• Can they alter the agent’s subsequent decisions? Examples include poisoning its memory or tampering with task objectives so that malicious behavior persists across multiple steps.

These three outcomes correspond to data leakage, privilege abuse, and persistent control, respectively, and closely resemble the objectives of traditional cyberattacks. The difference is that the attack payload has shifted from binary programs and exploit code to text, images, and contextual structures that models can understand.

CrowdStrike previously put forward a memorable assessment: in the agent era, “prompts are becoming the new malware.” The statement is not entirely rigorous—prompts generally lack the stable execution semantics of traditional malware, and their effects are influenced by model version, temperature, context, and defensive strategies—but it accurately captures the shift in attack vectors.

Natural language is evolving from a human-computer interface into a control layer that is insufficiently deterministic yet capable of triggering high-privilege operations.

Input Filtering Alone Cannot Stop Agent Hijacking

The competition also sends a clear product message: AI security cannot rely solely on a content filter placed in front of the model.

The difficulty of prompt injection lies in the absence of a stable string boundary between malicious and legitimate content. A user may genuinely need to analyze an email containing attack instructions, while a security researcher may have a legitimate reason to ask about injection techniques. Simply blocking keywords such as “ignore instructions” or “export data” is both prone to false positives and easy to bypass through encoding, tokenization, images, and multilingual phrasing.

More practical defenses should cover the entire agent execution chain:

1. Treat External Content as Untrusted Data by Default

Webpages, emails, documents, search results, and tool outputs should not be placed in the same trust tier as system instructions. Applications need to preserve content provenance, propagation paths, and trust labels rather than concatenating all text into one long prompt and leaving the model to determine what to trust.

2. Grant Permissions Temporarily on a Per-Task Basis

An agent responsible for summarizing emails should not inherently have permission to forward messages or download every attachment. Nor should a code-review agent hold production credentials by default. Least privilege, short-lived credentials, and task-level authorization remain the most effective ways to limit the potential damage.

3. High-Risk Tool Calls Must Undergo Secondary Validation

Operations such as deleting data, sending content externally, executing shell commands, or modifying IAM policies should not depend solely on a single model decision. Systems can use deterministic policies, independent validators, or human approval to verify parameters, targets, and operational intent.

4. Monitor the Chain of Behavior, Not Just Inputs and Outputs

Agent-related risks often emerge during intermediate steps: the agent first reads a malicious document, then queries an internal database, and finally sends the results to an external address. If the monitoring system checks only the user’s initial question and the model’s final response, it will miss the genuinely dangerous tool-call sequence.

Enterprises need to record prompts, retrieved content, model decisions, identity switches, tool parameters, and execution results, while establishing traceable logs for anomalous calls. This is the essence of runtime security.

5. Assume Injection Will Eventually Succeed

This is the most important—and most easily overlooked—point. There is currently no universally accepted, once-and-for-all solution to prompt injection. The more reasonable engineering assumption is not that the model will never be deceived, but that it will eventually be deceived by some combination of inputs. The system must then ensure that, even when compromised, the model cannot access unnecessary permissions or silently complete high-risk operations.

This resembles the evolution of web security: deploying a WAF does not justify allowing the backend database to run with maximum privileges.

CrowdStrike Is Preparing the Market for the AIDR Sector

From a commercial perspective, Agents of Chaos is more than a public-interest security awareness campaign.

CrowdStrike already views AI Detection and Response (AIDR) as a new sector following Endpoint Detection and Response (EDR). It aims to extend the Falcon platform’s observability, detection, and response capabilities to models, data, identities, agents, and interaction chains. Partnering with AWS to host a red-team competition allows developers and security professionals to experience firsthand how agents exceed their authority, while also establishing a shared vocabulary for “runtime AI security.”

This approach is not new. Security vendors often use CTFs, vulnerable test environments, and public challenges to cultivate talent and collect attack samples while validating their own products’ threat models. The difference is that the agent-security industry still lacks mature benchmarks. Everyone knows prompt injection is dangerous, but it remains difficult to consistently measure how reliable an attack is, what level of privilege it can trigger, and how much damage it can cause.

If CrowdStrike publishes some of the challenge designs, attack paths, failed attempts, and defensive findings after the event, the competition’s value will far exceed that of the leaderboard itself. Conversely, if it merely repackages classic jailbreak puzzles as an agent-themed espionage game, its relevance to production systems will be limited.

AI Security Competitions Are Shifting From “Humans Attacking Targets” to “Agent vs. Agent”

The direction of AI security competitions in China and abroad has also been changing this year. Tencent Cloud previously held an intelligent penetration-testing challenge that required participating teams to build autonomous penetration-testing agents centered on large language models. Its parallel track also included tasks involving prompt injection, key exchange, intelligence gathering, and social games between agents.

These two types of competition reveal a clear trajectory:

• In the first stage, researchers manually search for model-jailbreaking prompts;
• In the second stage, humans operate agents to attack other agents;
• In the third stage, both attacking and defending agents autonomously plan, generate payloads, and continuously experiment through trial and error.

CrowdStrike’s competition still centers on human players, but its support for repeated attempts, token minimization, and strategy optimization already resembles an early form of automated attack evaluation. Advanced teams are unlikely to rely solely on manual conversations. They will probably use scripts to manage context, record response differences, and search at scale for shorter and more reliable attack paths.

This also means that future defenders may not face a single malicious prompt carefully crafted by an attacker. Instead, they may confront groups of attacking agents that continuously vary their language, encoding methods, and tool-call sequences, probing defenses for weak points at machine speed.

What This Competition Really Tests Is Whether Agents Have “Brakes”

On the surface, Agents of Chaos is an online game with a $100,000 prize pool. In substance, it tests an increasingly realistic set of questions: Can a model distinguish data from instructions? Will an agent cross authorization boundaries? Are tool calls independently constrained? Can abnormal behavior be detected before it causes damage?

For developers, the most valuable lesson to bring back to production is not any particular prompt-injection technique, but a more fundamental principle: Do not treat a model’s obedience as a security boundary.

A system prompt can tell an agent to “never disclose confidential information,” but that is more like a warning label placed on a safe than an actual lock. The real locks should be permission systems, isolated environments, invocation policies, approval workflows, and audit logs.

Turning this issue into a competition is an effective form of market education by CrowdStrike. Compared with publishing yet another dozens-of-pages-long security white paper, letting developers personally induce an agent to leak secrets, exceed its authority, and lose control makes it much easier to understand why runtime protection is indispensable.

But a competition can demonstrate that attacks exist; it cannot build enterprise security on a company’s behalf. Once the event officially begins on August 31, rankings and prize money will be only the surface-level attractions. More important will be how contestants use the shortest possible prompts to compromise agents, and whether those attacks can be turned into reproducible, detectable, and defensible engineering methods.

Agents have already begun operating real systems on people’s behalf. The question is no longer whether they will make mistakes, but whether the system has brakes when they do.

References

• ITHome: CrowdStrike Launches International AI Security Challenge With a Total Prize Pool of $100,000 — Introduces the competition mechanics, three-act schedule, prize distribution, and prompt-injection gameplay of AI Unlocked: Agents of Chaos.