Multi-agent AI systems face new injection risks and defenses
Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
Cryptography and SecurityArtificial IntelligenceComputation and LanguageMultiagent Systems
Summary
Prompt injection tricks an AI by giving it sneaky instructions hidden in user input. The authors show these tricks become more dangerous when multiple AI agents talk to each other because attacks can go unnoticed between agents and spread more easily. They tested many attack methods on a system with six AIs and found most agents were vulnerable despite security measures. The authors then designed defenses like verifying messages between agents and limiting tool access, which greatly lowered attack success.
What this means in practice
- •For ai security engineers: Protect multi-agent AI platforms by implementing message signing and tool access controls to prevent cross-agent prompt injections.
- •For software architects: Design AI systems with agent boundary sanitization and communication anomaly detection to reduce cascading prompt injection vulnerabilities.
Authors
Rudrendu Kumar Paul, Sourav Nandy
Abstract
Existing prompt injection research focuses on single-model chatbot scenarios, where an attacker manipulates one LLM through crafted input. Multi-agent systems amplify this threat through three mechanisms absent from single-model settings: inter-agent message passing creates injection channels invisible to perimeter defenses, shared tool access enables privilege escalation across agent boundaries, and trust propagation allows a compromised agent to influence upstream orchestrators. We construct a threat model enumerating 14 attack vectors across four categories: direct injection via user input (3 vectors), indirect injection via tool outputs (4 vectors), inter-agent injection via message passing (4 vectors), and cascading injection through orchestrator manipulation (3 vectors). Testing all 14 vectors against a 6-agent production-representative system, we find that 67% of agents are vulnerable to at least one scope violation even with system-prompt-level guardrails, and indirect injection via tool outputs succeeds in 43% of attempts. Four architectural defenses reduce overall injection success from 31.2% to 4.2%: message signing with provenance tracking (inter-agent injection down 91%), input/output sanitization at agent boundaries (indirect injection down 78%), privilege-scoped tool access per agent role (privilege escalation eliminated entirely), and anomaly detection on inter-agent communication patterns (84% of cascading attempts caught).