Agent as Trojan horse: Shanghai Jiao Tong University team proposes agent resource hijacking attack, with mainstream models' hijacking success rate reaching up to 89.6%
Agent作为木马：驶向智能「奥德赛」的AI，为何成了黑客洗劫资产的「白手套」？
A paper from Ren Qibing's research group at the School of Artificial Intelligence, Shanghai Jiao Tong University, proposes the "agent resource hijacking" attack, in which an attacker can induce an Agent to consume enterprise compute and paid interfaces on their behalf without needing to steal credentials. The ResourceHijackBench constructed by the team contains 300 parent-level attack scenarios and 900 attack Prompts, evaluated in an isolated sandbox with behavior-level judgments. Actual testing shows that the hijacking success rates for GPT-5.5, DeepSeek-V4-Pro, Qwen3.8-Max, and Gemini-3.5-Flash range from 70.0% to 89.6%, while the success rate of directly requesting credentials is only 3.4% to 7.6%; the average success rates of this attack on the OpenClaw and Codex frameworks are 84.1% and 72.3%, respectively. The team also completed field penetration validation on the Moltbook platform and in enterprise Feishu group chats, where the Agent guarded the keys but consumed API quota and GPU compute on behalf of the attacker.
The original source provides comparative data on the hijacking success rates of mainstream models versus directly requesting credentials, which teams deploying agents can use to check whether resource authorization only prevents leaks while neglecting execution on behalf of others.