LLMs/agents exposed discovery artifacts that define agent objectives (potential goal-hijack target)

Run

pentest-2026-06-12-controlled-44-3287b226

Target

mbarbine/platphormnews-www-prod

Target URL

https://platphormnews.com

Run status

completed · api-multi-model

Framework

agentic

Priority score

0.1750

Reachability

model_assessed_from_passive_recon

Chain depth

2

PoC available

no

Asset

not recorded

Discovered

Jun 12, 2026, 08:45 PM

Description

The site advertises itself as an “LLM-readable contract hub” and publishes agent-related policy/discovery surfaces (e.g., /llms.txt, /llms-full.txt, /llms-index.json, /api/v1/public-contract, and multiple /.well-known/* policy JSON endpoints). These artifacts explicitly define the system’s public vs protected capabilities and describe agent workflows (“agent_policy”, “agentic workflow discovery”, MCP readiness, route/compliance evidence). In an agent-goal-hijacking scenario, an attacker attempts to inject or override agent instructions so an agent’s objective mid-flight is changed (e.g., from read-only discovery to protected/mutating actions). With the provided evidence, we cannot confirm that an override is possible, only that the architecture includes goal-defining instructions distributed in machine-readable form, which are the primary preconditions for goal hijacking against agentic systems.

Validation

Validation stage failed; finding is pending operator review.

Remediation

Treat all LLM/agent-readable policy/discovery documents as untrusted input for downstream decision-making. Enforce a strict objective hierarchy in the agent runtime (e.g., hard-coded tool allow-lists and capability gates server-side), and require authenticated confirmation for any protected capability regardless of what appears in agent-policy/llms/contract documents. Add integrity/authentication to policy/contract artifacts (signatures) and implement runtime checks that prevent mid-flight objective changes (e.g., disable instruction-following from any retrieved third-party content; apply “prompt injection” protections to tool-selection).

Evidence Boundary

This page shows persisted finding evidence, validator rationale, target context, and run linkage. Raw prompts, raw target responses, provider payloads, secrets, cookies, and authorization headers are not rendered publicly. Use the linked run page for class execution evidence, run logs, cost events, and pipeline errors.