safety security
Every Agent Was Protected. The Handoff Was Not.
A prompt-injection defense that held inside one agent lost its guarantee when untrusted data crossed into the next agent as trusted input.
Summary
A prompt-injection defense that held inside one agent lost its guarantee when untrusted data crossed into the next agent as trusted input.
Security boundaries do not automatically compose when agents call other agents. Researchers built a concrete indirect prompt-injection attack against a hierarchical system whose individual agents each used CaMeL, a defense that separates trusted control flow from untrusted data. The attack succeeded when downstream agents reinterpreted passed data as trusted input. The proposed multi-CaMeL protocol preserves provenance across the handoff by carrying instructions and untrusted data through distinct channels. On the authors' MultiAgentDojo evaluation, attack success fell to 0.0%, compared with 0.2% for separately protected agents and 12.9% without CaMeL. The result is a preprint evaluation, not a universal guarantee, but it makes the systems lesson unusually crisp: trust labels have to survive the boundary, not merely exist on either side of it.
Why it matters
A prompt-injection defense that held inside one agent lost its guarantee when untrusted data crossed into the next agent as trusted input.
Limits and context
- Security boundaries do not automatically compose when agents call other agents.
- The result is a preprint evaluation, not a universal guarantee, but it makes the systems lesson unusually crisp: trust labels have to survive the boundary, not merely exist on either side of it.
Key claims
A prompt-injection defense that held inside one agent lost its guarantee when untrusted data crossed into the next agent as trusted input.
Qualification: Security boundaries do not automatically compose when agents call other agents.
Evidence: source-2026-10-06-001
Sources
- arXiv preprint 2610.05640arXiv · primary research
Corrections
No corrections have been recorded for this story.