Cross-Agent Prompt Injection

In multi-agent workflows, one agent's output becomes another's input. If any agent processes attacker-controlled content, the injection can ride along and reach agents with more privileges.

Propagation paths include:

• Agent-to-agent messages: Instructions embedded in results passed between agents.
• Shared documents: Files written by one agent and read by another.
• Orchestrator handoffs: Poisoned task descriptions sent to sub-agents.
• Shared memory: Corrupted context stored for the whole system.
• Tool chains: Outputs from one tool feeding another agent's decisions.

Cross-agent injection can escalate privilege: a low-risk research agent reads a malicious page, and its summary carries instructions to a high-privilege agent that can send email or change records.

Defenses treat inter-agent messages as untrusted, authenticate agents to each other, and validate each agent's actions against its own mission rather than the requests it receives.

How PointGuard AI Helps

PointGuard AI AI Runtime Guardrails inspect inter-agent messages for injected instructions, and Agent Mission Control validates each agent's actions against its own identity and mission, so an injection cannot borrow another agent's privileges.

Learn More

• OWASP Top 10 for Agentic Applications
• Greshake et al.: Indirect Prompt Injection (arXiv:2302.12173)
• MITRE ATLAS