Cross-Agent Prompt Infection in Multi-Agent Pipelines
First seen Jul 3, 2026 · Updated Jul 3, 2026
Adversarial instructions planted in content processed by one agent can replicate into its outputs and infect downstream agents, spreading through normal inter-agent messaging the way the Morris II research worm spread through AI email assistants.
Technical Analysis
Multi-agent systems pass unvetted natural-language messages between planners, workers, and tool users. A payload that convinces one agent to include it verbatim in summaries, tickets, or memos rides those channels to every consumer of that output. Each hop can trigger tool calls, memory writes, or further replication, so a single poisoned document can contaminate an entire agent network.
Affected Systems
Multi-agent frameworks passing free-form text between agents (LangGraph, AutoGen, CrewAI and similar); protocols: A2A, custom message buses
Detection Signatures
- Identical unusual instruction phrases appearing across multiple agents' outputs
- Agents citing directives that appear in no system prompt
- Spikes in agent-initiated messages following ingestion of a single external document
Remediation Steps
- 1
Validate inter-agent messages
Schema-constrain agent-to-agent messages; strip or flag imperative text in fields meant for data.
- 2
Track provenance
Tag content derived from external inputs and lower its privilege downstream.
- 3
Gate consequential actions
Require human approval for actions triggered by externally derived content.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.