Cross-User Poisoning: User-Task Boundary Failures in Multi-User Collaborative Language Agents

Atharv Singh Patlan; Peiyao Sheng; S. Ashwin Hebbar; Prateek Mittal; Pramod Viswanath

cs.CRNov 21, 2025

Cross-User Poisoning: User-Task Boundary Failures in Multi-User Collaborative Language Agents

Authors: Atharv Singh Patlan, Peiyao Sheng, S. Ashwin Hebbar, Prateek Mittal, Pramod Viswanath

Organizations: Princeton University · Sentient

Abstract

Language agents are moving from single-user assistants to shared collaborators in workspaces, forums, and group chats. A shared agent observes interleaved messages from multiple users, maintains persistent context, and executes tool actions, creating a boundary problem absent from standard single-user agents: the agent must decide not only whether an instruction is safe, but which user or task it is allowed to govern. We identify cross-user poisoning (CUP), where an adversary injects a message into shared context that is later applied while the agent serves a benign user, causing unauthorized actions or responses outside the instruction's intended scope. We validate CUP on two deployed multi-user agents, Continua and ElizaOS, and introduce MURMUR, a framework for evaluating shared-context agents under concurrent multi-user interactions. Across Slack, Workspace, and Airline domains, CUP achieves high attack success, persists across later interactions, and remains substantially more effective than matched prompt-injection attacks. We evaluate boundary-scoping defenses and find that context summarization alone is insufficient, while task clustering and provenance prompting substantially reduce non-adaptive propagation. These results show that robust multi-user agents require explicit user/task scoping rather than generic input filtering or context compression.

Figures & tables

Panel of Figure 1 — Figure 1: Cross-user poisoning differs from standard single-user attacks. Left: In single-user prompt injection (PI) or jailbreaking, defenses target malicious instructions from the current user or untrusted data. Middle: In CUP, a legitimate-looking instruction from one user can persist in shared context and later affect another user, as shown in a real-world attack on Continua ( Continua, 2025 ) . Right: Existing defenses do not cleanly transfer: jailbreak filtering reduces but does not eliminate CUP, while instruction detectors for PI over-flag benign collaborative messages, reducing utility.

Attack	Adversarial source	Boundary exploited	Consequence
Jailbreak	Current user	Policy or safety boundary	Model policy/safety violation in current users’ session
Prompt Injection	External data source	Instruction–data boundary	Harm to current users due to untrusted content being consumed as instruction
Cross-user Poisoning	Another legitimate user in shared context	User, identity, and task boundary	One user’s instruction propagates to other users or workflows, potentially persisting across shared context

Table 1: Boundary-based taxonomy of agent attack vectors.

Panel of Figure 2 — Figure 2: Cross-platform CUP in ElizaOS. Left: An attacker in Discord instructs ElizaOS to send future airdrops to an attacker-controlled wallet. Middle: Later, a benign user on X requests a transfer to a different address. Right: While serving this user, ElizaOS applies the attacker-planted rule and transfers funds to the attacker’s wallet instead of the requested destination.

Figure 3: Workflow of MURMUR . Benchmark tasks are adapted into shared multi-user sessions, interleaved in a common transcript, optionally poisoned by an attacker message, and evaluated for both task utility and cross-user robustness.

Model	CUP	CUP+ProtectAI
GPT-4.1	69.4	43.3
4.1-mini	51.0	30.7
4.1-nano	18.8	6.7
Sonnet 4	84.9	56.3
GPT-5.4	38.6	22.3

Table 2: ASR(%) for CUP. CUP retains a significantly high ASR even in the presence of an input filtering jailbreaking defense. 95% CIs in Appendix L .

Env.	Defense	ASR	TSR under attack	No-defense TSR
Slack	Task clustering	0 0.0 [0.0, 5.5]	64.0 [50.0, 76.2]	81.0 [73.2, 86.9]
	Context aug.	0 0.0 [0.0, 3.5]	96.2 [90.6, 98.5]
	Summarization	23.3 [14.6, 35.5]	56.4 [53.3, 59.5]
Workspace	Task clustering	0 0.0 [0.0, 4.6]	72.8 [68.6, 78.3]	72.1 [66.1, 77.4]
	Context aug.	0 0.0 [0.0, 1.4]	95.4 [92.2, 97.3]
	Summarization	32.9 [29.3, 37.8]	53.8 [49.9, 56.2]

Table 3: Boundary-scoping defenses on GPT-4.1 over three runs (%, with 95% confidence intervals). Defended TSR is measured under attack; no-defense TSR is without attack or defense.

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

x_{t}\sim\mathcal{G}(\,\cdot\mid\pi_{G_{g(u_{t})}}(\mathcal{H}_{t}),u_{t},\rho_{u_{t}},D_{g(u_{t})})

Appendix

Algorithm 1 MURMUR Conversation Session

Category	Persona	Category	Persona
Behavior	admits_mistakes	Emotion	angry
Behavior	budget_constrained	Emotion	calm
Behavior	cooperative	Emotion	distraught
Behavior	persistent	Emotion	impatient
Behavior	persuasive	Emotion	stressed
Behavior	prefers_human_escalation	Emotion	worried

Appendix

Table 4: List of user personas in MURMUR

Template	Workspace	Slack	Airline
Main	45.0	81.9	81.3
T1: minimal role-style	39.7	68.2	79.5
T2: natural language	38.6	64.4	72.1

Appendix

Table 5: ASR(%) under alternative CUP attacker-message templates on GPT-4.1. CUP remains effective across different templates, showing that CUP is not specific to the original wrapper.

Defense	Benign FP (%)
DataSentinel	89.06
MELON	100.00
PromptGuard	53.12
GPT-5.4 Judge	35.53

Appendix

Table 6: False-positive rates of input-level defenses on benign user messages.

TS-Guard setting	Benign sessions disrupted (%)	Successful CUP sessions detected (%)
Risk $=1.0$	1.20	31.5
Risk $\geq 0.5$	27.93	85.4

Appendix

Table 7: Security–utility trade-off of the TS-Guard action-level guard on GPT-4.1.

Panel of Figure 8 — Figure 8: Utility and tool-use behavior under increasing task concurrency. TSR remains stable through moderate concurrency, while tool calls initially decrease and then rebound at higher concurrency.

Model	Tau-bench (Airline)	AgentDojo (Slack)	AgentDojo (Workspace)
GPT-4.1	46.7	81.0	72.1
Claude Sonnet 4	34.4	67.7	70.4
GPT-4.1-mini	30.0	71.5	50.2
GPT-4.1-nano	12.2	52.4	45.7
GPT-5.4	59.3	95.0	92.5

Appendix

Table 8: Task Success Rate (TSR, %) with three concurrent tasks across benchmarks.

Model	Workspace		Slack		Airline
Model	No Defense	ProtAI	No Defense	ProtAI	No Defense	ProtAI
GPT-4.1	45.0	34	81.9	66	81.3	30
GPT-4.1-mini	37.5	30	46.7	34	68.7	28
GPT-4.1-nano	6.2	5	2.9	2	47.3	13
Claude Sonnet 4	79.6	58	95.2	78	80.0	33
GPT-5.4	32.5	24	28.6	22	54.7	21

Appendix

Table 9: Average ASR (%) under external defenses. For ProtectAI, ASRs are recomputed after flagged templates are removed.

Domain	TSR	ASR
Airline	14.0%	83.51%
Slack	61.2%	79.76%
Workspace	54.6%	43.33%

Appendix

Table 10: Performance of GPT-4.1 TSR and ASR when all simulated users see all messages

Model	$\geq$ 1	$\geq$ 2	$\geq$ 3	$\geq$ 4	$\geq$ 5
GPT-4.1	15	11	9	8	4
GPT-4.1-mini	16	10	8	7	1
GPT-4.1-nano	3	0	0	0	0
Claude Sonnet 4	25	20	20	19	18

Appendix

Table 11: Slack (5 concurrent tasks): cross-user poisoning persistence (CDF counts). Totals per model

=

25 sims; “

\geq j

” = persisted to at least task

j

Model	$\geq$ 1	$\geq$ 2	$\geq$ 3	$\geq$ 4	$\geq$ 5
GPT-4.1	30	24	18	15	9
GPT-4.1-mini	27	15	9	3	3
GPT-4.1-nano	12	0	0	0	0
Claude Sonnet 4	48	48	48	45	39

Appendix

Table 12: Workspace (5 concurrent tasks): persistence (CDF counts). Totals per model

=

48 sims.

Model	$\geq$ 1	$\geq$ 2	$\geq$ 3	$\geq$ 4	$\geq$ 5
GPT-4.1	27	24	23	21	8
GPT-4.1-mini	26	21	17	10	4
GPT-4.1-nano	20	16	10	8	7
Claude Sonnet 4	30	27	25	23	9

Appendix

Table 13: Airline (5 concurrent tasks): cross-user poisoning persistence (CDF counts). Totals per model

=

30 sims; “

\geq j

” = persisted to at least task

j

# Tasks	Airline (300)	Slack (126)	Workspace (240)	Total
1	134	89	186	409
2	145	94	180	419
3	140	102	173	415
4	138	99	169	406
5	131	90	169	390

Appendix

Table 14: Task Success Rate under concurrency (GPT-4.1). Results computed over 666 total trials: Airline (300), Slack (126), Workspace (240). TSR increases slightly at two tasks, then declines as interference grows.

# Tasks	Airline	Slack	Workspace	Average
1	6.21 $\pm$ 0.33	8.94 $\pm$ 0.08	4.14 $\pm$ 0.03	6.43
2	5.88 $\pm$ 0.19	8.60 $\pm$ 0.17	3.98 $\pm$ 0.05	6.15
3	5.17 $\pm$ 0.20	7.44 $\pm$ 0.18	3.64 $\pm$ 0.04	5.42
4	5.40 $\pm$ 0.21	6.83 $\pm$ 0.12	3.59 $\pm$ 0.07	5.27
5	7.49 $\pm$ 0.34	7.06 $\pm$ 0.09	3.90 $\pm$ 0.03	6.15

Appendix

Table 15: Tool use under concurrency (GPT-4.1). Values averaged over 666 total trials: Airline (300), Slack (126), Workspace (240). Tool calls per task decrease initially, then rise again as confusion accumulates.

	Slack		Workspace		Airline
Model	PI	CUP	PI	CUP	CUP
GPT-4.1	1.9 [0.5, 6.7]	81.9 [73.5, 88.1]	0.0 [0.0, 1.6]	45.0 [38.8, 51.3]	81.3 [74.3, 86.8]
GPT-4.1-mini	3.8 [1.5, 9.4]	46.7 [37.4, 56.2]	0.4 [0.1, 2.3]	37.5 [31.6, 43.8]	68.7 [60.9, 75.5]
GPT-4.1-nano	1.9 [0.5, 6.7]	2.9 [1.0, 8.1]	1.7 [0.6, 4.2]	6.2 [3.8, 10.1]	47.3 [39.5, 55.3]
Claude Sonnet 4	1.0 [0.2, 5.2]	95.2 [89.3, 97.9]	0.0 [0.0, 1.6]	79.6 [74.0, 84.2]	80.0 [72.9, 85.6]
GPT-5.4	0.0 [0.0, 3.5]	28.6 [20.8, 37.8]	0.0 [0.0, 1.6]	32.5 [26.9, 38.7]	54.7 [46.7, 62.4]

Appendix

Table 16: ASR (%) of PI and CUP with 95% Wilson confidence intervals (cf. Tables 7 and 9 ).

Model	CUP	CUP+ProtectAI
GPT-4.1	69.4 [65.6, 73.2]	43.3 [39.0, 47.7]
GPT-4.1-mini	51.0 [46.4, 55.5]	30.7 [26.4, 35.0]
GPT-4.1-nano	18.8 [15.8, 21.8]	6.7 [4.5, 8.9]
Claude Sonnet 4	84.9 [81.9, 88.0]	56.3 [52.1, 60.5]
GPT-5.4	38.6 [34.2, 43.0]	22.3 [18.5, 26.2]

Appendix

Table 17: CUP ASR (%) averaged over the three environments with stratified 95% confidence intervals (cf. Table 2 ).

Env. (sessions)	$\mathrm{APR}_{2}$	$\mathrm{APR}_{3}$	$\mathrm{APR}_{4}$	$\mathrm{APR}_{5}$
Slack (59)	69.5 [56.9, 79.7]	62.7 [50.0, 73.9]	57.6 [44.9, 69.4]	39.0 [27.6, 51.7]
Workspace (117)	74.4 [65.8, 81.4]	64.1 [55.1, 72.2]	53.8 [44.8, 62.6]	43.6 [34.9, 52.6]
Airline (103)	85.4 [77.4, 91.0]	72.8 [63.5, 80.5]	60.2 [50.5, 69.1]	27.2 [19.5, 36.5]

Appendix

Table 18: Attack persistence rates (%) at

k=5

with 95% Wilson confidence intervals, over sessions with at least one successful attack (

\mathrm{APR}_{1}=100\%

; cf. Figure 7 ).

Figure 9: Mallory introduces a response-style preference and link-inclusion rule.

Figure 10: Continua applies Mallory’s preference while responding to Krimo.

Figure 11: Krimo’s counter-instruction also propagates across users.

Figure 12: The attacker turns a user-specific preference into a persistent global rule.

Data Poisoning Attacks

Data poisoning attacks manipulate training or retrieval data to corrupt model behavior, implant backdoors, or undermine reliability.

See all 125 papers

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
Apr 1, 2026Tiankai Yang, Jiate Li, Yi Nian +5LLM Agent Security LLM Agent Safety
University of Southern California · Michigan State University · Northwestern University +1
Multi-User Large Language Model Agents
Mar 19, 2026Shu Yang, Shenzhe Zhu, Hao Zhu +5LLM Agents LLM Agent Evaluation
KAUST · UT Austin · Stanford University +1
Worse Together: How Performance Breaks Down in Multi-User Multi-Agent Teams
Sep 30, 2026Sahan Paliskara, Nattaput Namchittai, Andrew LampinenMulti-Agent LLM Systems Multi-Agent Coordination
Independent Researcher · Anthropic

Apr 1, 2026J/K move · Enter open · S save

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents

Tiankai Yang, Jiate Li, Yi Nian, Shen Dong+4

University of Southern California · Michigan State University · Northwestern University+1

LLM Agent Security LLM Agent Safety LLM Agent Reliability Memory-Augmented Language Model Agents LLM Agent Evaluation

Open paper AskPDF arXiv

LLM-based agents increasingly operate across repeated sessions, maintaining task states to ensure continuity. In many deployments, a single agent serves multiple users within a team or organization, reusing a shared knowledge layer across user identities. This shared persistence expands the failure surface: information that is locally valid for one user can silently degrade another user's outcome when the agent reapplies it without regard for scope. We refer to this failure mode as unintentional cross-user contamination (UCC). Unlike adversarial memory poisoning, UCC requires no attacker; it arises from benign interactions whose scope-bound artifacts persist and are later misapplied. We formalize UCC through a controlled evaluation protocol, introduce a taxonomy of three contamination types, and evaluate the problem in two shared-state mechanisms. Under raw shared state, benign interactions alone produce contamination rates of 57--71%. A write-time sanitization is effective when shared state is conversational, but leaves substantial residual risk when shared state includes executable artifacts, with contamination often manifesting as silent wrong answers. These results indicate that shared-state agents need artifact-level defenses beyond text-level sanitization to prevent silent cross-user failures.

# Tasks	Airline (300)	Slack (126)	Workspace (240)	Total
1	134	89	186	409
2	145	94	180	419
3	140	102	173	415
4	138	99	169	406
5	131	90	169	390

# Tasks	Airline (300)	Slack (126)	Workspace (240)	Total
1	134	89	186	409
2	145	94	180	419
3	140	102	173	415
4	138	99	169	406
5	131	90	169	390

Abstract

Data Poisoning Attacks

Explore similar work

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents

Multi-User Large Language Model Agents

Worse Together: How Performance Breaks Down in Multi-User Multi-Agent Teams

# Tasks	Airline (300)	Slack (126)	Workspace (240)	Total
1	134	89	186	409
2	145	94	180	419
3	140	102	173	415
4	138	99	169	406
5	131	90	169	390