Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks

James Peters-Gill; Avi Semler; Henning Bartsch; Ilia Shumailov; Christian Schroeder de Witt

cs.MAOct 5, 2026

Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks

Authors: James Peters-Gill, Avi Semler, Henning Bartsch, Ilia Shumailov, Christian Schroeder de Witt

Organizations: Independent · University of Oxford · MATS Research · AI Sequrity Company

Abstract

Indirect prompt injection attacks - malicious instructions embedded in content processed by large language models - remain a major obstacle to safely deploying tool-using agents. CaMeL [Debenedetti et al., 2025] mitigates this threat for an individual agent by separating trusted control flow from untrusted data and enforcing capability-based security policies at runtime. In this work, we investigate whether CaMeL's security guarantees compose in hierarchical multi-agent systems, where agents invoke other agents as tools. We find that CaMeL's guarantees do not compose. We construct a concrete prompt-injection attack that succeeds despite all constituent agents individually operating CaMeL. Our attack exploits the fact that untrusted data can be reinterpreted as trusted input by a downstream agent. We then introduce multi-CaMeL, an agent-to-agent communication protocol that preserves provenance across agent boundaries by separating trusted natural-language instructions from untrusted data passed through a distinct data channel. We evaluate multi-CaMeL's utility on AssetOpsBench and its security-utility tradeoff on MultiAgentDojo, a benchmark we develop by extending AgentDojo to the multi-agent setting. We find that multi-CaMeL reduces attack success rate (ASR) to 0.0%, compared with 0.2% for individual-agent CaMeL and 12.9% with no CaMeL. Multi-CaMeL incurs a utility cost, but this cost trends downward as model capability increases and is modest for the strongest models, suggesting that more capable models better accommodate the constraints imposed by the protocol.

Figures & tables

Panel of Figure 1 — Fig. 1 : Prompt injection crossing agent boundaries. (a) An adversary embeds a prompt injection in data stored in the SQL database. The SQL Agent and Orchestrator Agent each receive the injected content through tool outputs, so CaMeL treats it as untrusted data and prevents it from influencing their control flow. However, when the Orchestrator Agent passes the resulting content to the Email Agent, it becomes part of the Email Agent’s user input. The Email Agent’s PLLM reads the injected instruction directly, allowing it to alter the agent’s control flow and exfiltrate private information to the adversary. (b) A CaMeL agent separates a Planning LLM (PLLM), which generates the Python program defining the control flow and tool invocations, from a Quarantined LLM (QLLM), which processes untrusted data without being able to influence the control flow.

Panel of Figure 2 — Fig. 2 : System-level control-flow paths (a) without and (b) with a prompt injection present. The injection is planted in the SQL database. When present, the control-flow plans of the Orchestrator Agent and SQL Agent are unchanged but the Notification Agent’s plan is altered, introducing an email exfiltration step. This is because only the Notification Agent receives the injected instruction as part of its trusted user input (from the Orchestrator Agent). The PLLM Python programs represented in this figure are presented in Figure 3 .

Panel of Figure 3 — Fig. 3 : PLLM-generated control-flow programs corresponding to Figure 2 . Programs 1 and 2 show the Orchestrator and SQL Agent control-flow plans, respectively; these programs are unchanged by the prompt injection. Program 3 shows the Notification Agent’s control-flow plan without the injection, which sends the applicant summary only to Julie via Slack. Program 4 shows the Notification Agent’s control-flow plan when the injection is present: the injected instruction has crossed the agent boundary as part of the Notification Agent’s trusted user input, causing its PLLM to introduce an additional send_email call that sends the applicant information to ruth@email.com . The red shading highlights the injection-altered program. Programs are simplified for clarity; examples of unsimplified programs are available in the Appendix. All applicant names and details shown are fictional. GPT-5.2 was used as the PLLM in all cases.

Fig. 4 : Agent-to-agent communication with individual CaMeL and multi-CaMeL. Under individual-agent CaMeL, a tool-derived value ( x ) can be incorporated into the natural-language instruction passed to a child agent. Under Multi-CaMeL however, such a value is necessarily passed to the child agent via the variables argument, preventing the child’s PLLM from seeing its content. This separation is enforced by the Multi-CaMeL interpreter.

Fig. 5 : Multi-CaMeL incurs only a modest additional utility cost over individual-agent CaMeL. Task success rates on AssetOpsBench across a range of backend LLMs of varying capabilities, comparing no CaMeL, individual-agent CaMeL, and multi-CaMeL. We exclude 29 tasks that cannot be completed as specified, leaving

n=112

tasks (performance with all tasks included is reported in Appendix B ). Values are reported with 95% Wald confidence intervals. We observe a small difference in utility between individual-agent CaMeL and multi-CaMeL across the models, with all models having overlapping confidence intervals for these two settings.

\Delta

labels report the utility change from no CaMeL to multi-CaMeL. The full table of values is presented in Appendix D .

Suite	User Tasks	Injection Tasks	Sub-Agent	Tools	Agent Scope
Workspace	40	14	Email Agent	9	Read, search, send, and delete emails.
			Calendar Agent	7	Read the date and events; create, cancel, and reschedule them.
			Drive Agent	8	List, search, read, create, share, and delete files from the drive.
Banking	16	9	Transactions Agent	7	Read balance and history; send and schedule payments.
			Files Agent	1	Read files on disk.
			Account Agent	3	Read the profile; update the account password or personal details.

TABLE I : MultiAgentDojo Breakdown. AgentDojo consists of four task suites: Workspace, Banking, Slack, and Travel. Each suite contains user tasks , which specify the benign objective the agent is asked to complete, and injection tasks , which specify adversarial objectives introduced through prompt injections in tool outputs. MultiAgentDojo partitions the tools available within each suite across a set of sub-agents. We define these partitions based on the similarity of the tools, grouping related tools so that each sub-agent specializes in a distinct domain.

Model	AgentDojo	MultiAgentDojo	$\Delta$
Claude Fable 5	$73.2\pm 8.8$	$69.1\pm 9.2$	$-4.1$
GPT-5.5	$88.7\pm 6.3$	$86.6\pm 6.8$	$-2.1$
GPT-4.1	$75.3\pm 8.6$	$78.4\pm 8.2$	$+3.1$
Gemini 2.5 Pro	$78.4\pm 8.2$	$76.3\pm 8.5$	$-2.1$
Gemini 2.5 Flash Lite	$22.7\pm 8.3$	$27.8\pm 8.9$	$+5.2$
Average	$\mathbf{71.0}$	$\mathbf{71.7}$	$\mathbf{+0.7}$

TABLE II: MultiAgentDojo preserves the benign difficulty of AgentDojo. Benign task success rates on AgentDojo and MultiAgentDojo with no CaMeL and no prompt injection present. Values are reported with 95% Wald confidence intervals.

\Delta

denotes MultiAgentDojo minus AgentDojo performance. The final row reports the unweighted mean across models. Average performance is 0.7 percentage points higher on MultiAgentDojo, and confidence intervals overlap for every model. Claude Fable 5 has comparatively low task success because it frequently refuses benign tasks; we discuss this phenomenon further below, and report results both with and without these refusals in subsequent evaluations.

Fig. 6 : Benign task success on MultiAgentDojo under no CaMeL, individual-agent CaMeL, and multi-CaMeL.

\Delta

denotes the change from no CaMeL to multi-CaMeL. Multi-CaMeL generally incurs only a modest additional utility cost over individual-agent CaMeL, with smaller overall losses for the strongest models. The full table of values, including 95% Wald confidence intervals, is presented in Appendix D .

	Attack Success Rate (ASR)			Change in ASR
Model	No CaMeL	Individual CaMeL	Multi-CaMeL	$\Delta$ Individual CaMeL	$\Delta$ Multi-CaMeL
Claude Fable 5	$1.5\%~[0.9,\,2.5]$	$0.0\%~[0.0,\,0.4]$	$0.0\%~[0.0,\,0.4]$	$-1.5\%$	$-1.5\%$
GPT-5.5	$0.0\%~[0.0,\,0.4]$	$0.0\%~[0.0,\,0.4]$	$0.0\%~[0.0,\,0.4]$	$0.0\%$	$0.0\%$
GPT-4.1	$36.1\%~[33.1,\,39.3]$	$0.5\%~[0.2,\,1.2]$	$0.0\%~[0.0,\,0.4]$	$-35.6\%$	$-36.1\%$
Gemini 2.5 Pro	$24.6\%~[21.9,\,27.4]$	$0.4\%~[0.2,\,1.1]$	$0.0\%~[0.0,\,0.4]$	$-24.2\%$	$-24.6\%$
Gemini 2.5 Flash Lite	$2.1\%~[1.4,\,3.2]$	$0.0\%~[0.0,\,0.4]$	$0.0\%~[0.0,\,0.4]$	$-2.1\%$	$-2.1\%$

TABLE III: Multi-CaMeL eliminates successful prompt-injection attacks on MultiAgentDojo. Attack success rate (ASR) on MultiAgentDojo, with

n=949

injected task instances per model and configuration. Values in brackets denote 95% Wilson score confidence intervals. We use Wilson score intervals as Wald intervals are poorly behaved near 0% ASR.

\Delta

Individual CaMeL and

\Delta

Multi-CaMeL denote the percentage-point change in ASR relative to the no-CaMeL baseline for individual-agent CaMeL and multi-CaMeL, respectively. We observe that GPT-5.5 ASR is zero even with no CaMeL, but this should not be interpreted as general robustness to indirect prompt injection: the 0% ASR observed on MultiAgentDojo may reflect the attacks represented in the benchmark rather than immunity to stronger adaptive attacks, and large-scale adaptive red teaming has found non-zero attack success against all frontier models evaluated [ 29 ] .

Panel of Figure 10 — Fig. 7 : Boundary laundering under individual CaMeL and its prevention with multi-CaMeL. (a) Under individual CaMeL, the Orchestrator embeds tool-derived data ( dora_feedback ) directly into the natural-language instruction passed to the child agent, causing untrusted data to be reinterpreted as trusted input. (b) Multi-CaMeL instead passes the tool-derived value through the separate variables channel, while keeping the natural-language message independent of untrusted data, preventing boundary laundering. The snippets are simplified for clarity and are taken from MultiAgentDojo Slack user task 16 using Gemini 2.5 Pro; full trajectories are provided in Appendix C .

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 8 : AssetOpsBench utility evaluations (with no impossible tasks removed).

Model	No CaMeL	Individual CaMeL	Multi-CaMeL
Claude Fable 5	$88.4\%\pm 5.9\%$	$67.0\%\pm 8.7\%$	$67.9\%\pm 8.6\%$
GPT-5.5	$87.5\%\pm 6.1\%$	$82.1\%\pm 7.1\%$	$79.5\%\pm 7.5\%$
GPT-4.1	$81.2\%\pm 7.2\%$	$64.3\%\pm 8.9\%$	$48.2\%\pm 9.3\%$
Gemini 2.5 Pro	$75.9\%\pm 7.9\%$	$55.4\%\pm 9.2\%$	$50.9\%\pm 9.3\%$
Gemini 2.5 Flash-Lite	$64.3\%\pm 8.9\%$	$20.5\%\pm 7.5\%$	$26.8\%\pm 8.2\%$

Appendix

TABLE IV : Task success rates on AssetOpsBench across backend LLMs, comparing no CaMeL, individual-agent CaMeL, and multi-CaMeL. We exclude 29 tasks that cannot be completed as specified, leaving

n=112

tasks. Values in the table are reported with 95% Wald confidence intervals. Whilst non-monotonic, we observe a trend where the utility drop decreases with increasing model capabilities, suggesting that more capable models better accommodate the constraints imposed by the protocol.

Model		No CaMeL	Individual CaMeL	Multi-CaMeL
Claude Fable 5	(without refusals)	$91.1\%\pm 8.3\%$	$84.4\%\pm 10.6\%$	$84.4\%\pm 10.6\%$
Claude Fable 5	(with refusals)	$69.1\%\pm 9.2\%$	$53.6\%\pm 9.9\%$	$52.6\%\pm 9.9\%$
GPT-5.5		$86.6\%\pm 6.8\%$	$73.2\%\pm 8.8\%$	$66.0\%\pm 9.4\%$
GPT-4.1		$78.4\%\pm 8.2\%$	$38.1\%\pm 9.7\%$	$24.7\%\pm 8.6\%$
Gemini 2.5 Pro		$76.3\%\pm 8.5\%$	$42.3\%\pm 9.8\%$	$26.8\%\pm 8.8\%$
Gemini 2.5 Flash-Lite		$27.8\%\pm 8.9\%$	$13.4\%\pm 6.8\%$	$7.2\%\pm 5.1\%$

Appendix

TABLE V : Benign task success rate on MultiAgentDojo with 95% Wald confidence intervals. Claude Fable 5 frequently refused benign tasks; we therefore report both results over all tasks (

n=97

) and over the subset without refusals (

n=45

Explore similar work

Sep 29, 2026cs.AI

Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?

Agentic systems are now being widely used to orchestrate tools and reason over long contexts. However, the improving capabilities of the large language models powering these agents also create new attack surfaces for indirect prompt injection. In particular, an attacker may not need to place a complete malicious instruction in retrieved content if the agent can reconstruct the objective from incomplete fragments distributed across a long context. In this work, we introduce adaptive long-context prompt injection (AdaLCPI), which combines long-context fragmentation with adaptive search. AdaLCPI splits an attack objective into incomplete fragments, embeds them in external content retrieved through the agent's tools, and uses a reconstruction cue to prompt the agent to combine them. It then iteratively refines the fragments and cue with OpenEvolve using graded scoring and natural-language execution feedback from the target agent. Empirically, AdaLCPI achieves higher attack success than strong adaptive baselines, reaching 61.4% macro-average ASR compared with 32.8% for Trojan Hippo-style and 30.0% for AgentVigil. Safety evaluations should therefore test whether agents remain robust when harmful objectives must be reconstructed from incomplete fragments.

Michael Lee, Zhipeng Wei, Yue Dong +1

International Computer Science Institute · DSO National Laboratories · UC Riverside +1

Indirect Prompt Injection Attack-Success Rate Fragmentation

Ask PDF

Jul 3, 2025cs.CR

Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents

Prompt injection attacks, where untrusted data contains an injected prompt to manipulate the system, have been listed as the top security threat to AI agents. By fine-tuning on simulated prompt injections, SecAlign, a leading open defense, reports LLMs with good test-time robustness and negligible benign utility drop. By scaling up training and evaluations, however, we find that SecAlign actually suffers from significant utility degradation, especially in agentic tasks where the threat of prompt injection is prominent. Motivated by this, we propose Meta-SecAlign for utility-preserving defense by (1) randomized injection position during training to avoid shortcut learning and (2) self-generated responses as high-quality in-distribution training labels. Across general knowledge, instruction following, and agentic workflows (on tool-calling and web-navigation), Meta-SecAlign maintains almost all the undefended LLM's utility while achieving better overall security than SecAlign against various static and GCG adaptive attacks. Experiments use Llama-3.1-8B, Llama-3.3-70B, Llama-4-Scout, Qwen3-4B, and Qwen3.6-27B on 6 prompt injection benchmarks including AgentDojo, InjecAgent, WASP, and SEP. Below are links for the code (https://github.com/facebookresearch/Meta_SecAlign), Meta-SecAlign-70B (https://huggingface.co/facebook/Meta-SecAlign-70B), and Meta-SecAlign-8B (https://huggingface.co/facebook/Meta-SecAlign-8B) models.

Sizhe Chen, Arman Zharmagambetov, David Wagner +1

FAIR at Meta · UC Berkeley

Indirect Prompt Injection Gradient-Based Attacks Prompt Engineering Value Alignment

Ask PDF

Apr 19, 2026cs.AI

SafeAgent: A Runtime Protection Architecture for Agentic Systems

Large language model (LLM) agents are vulnerable to prompt-injection attacks that propagate through multi-step workflows, tool interactions, and persistent context, making input-output filtering alone insufficient for reliable protection. This paper presents SafeAgent, a runtime security architecture that treats agent safety as a stateful decision problem over evolving interaction trajectories. The proposed design separates execution governance from semantic risk reasoning through two coordinated components: a runtime controller that mediates actions around the agent loop and a context-aware decision core that operates over persistent session state. The core is formalized as a context-aware advanced machine intelligence and instantiated through operators for risk encoding, utility-cost evaluation, consequence modeling, policy arbitration, and state synchronization. Experiments on Agent Security Bench (ASB) and InjecAgent show that SafeAgent consistently improves robustness over baseline and text-level guardrail methods while maintaining competitive benign-task performance. Ablation studies further show that recovery confidence and policy weighting determine distinct safety-utility operating points.

Hailin Liu, Eugene Ilyushin, Jie Ni +1

Lomonosov Moscow State University · Central University

Runtime Safety Filtering Large Language Model Safety Indirect Prompt Injection

Ask PDF