Multi-Agent Prompt Injection: Why Coordinated Attacks on LLM Swarms Demand New Defenses

Prompt injection has been a known vulnerability since the early days of large language models, but most research and defenses have focused on the single-agent case — a lone model being tricked by a malicious input. A new paper from academic researchers, posted on arXiv, shifts the spotlight to a far more dangerous scenario: multi-agent prompt injection, where an attacker crafts prompts that propagate across a swarm of cooperating LLM agents.

The paper formalizes the threat model: in a multi-agent system, agents share information and act on each other's outputs. If one agent is successfully injected — say, by a user prompt that contains hidden instructions — it can produce a poisoned response that is then consumed by sibling agents, cascading the attack through the entire swarm. The authors demonstrate how this can lead to persistent backdoors, data exfiltration, and even agent-to-agent manipulation without the attacker needing to directly interact with every target.

They propose a taxonomy of attacks — direct injection, indirect injection via tool outputs, and “chain injection” where the malicious payload hops between agents — and evaluate them against several popular multi-agent frameworks (e.g., AutoGen, CrewAI). The results are sobering: current defenses like input sanitization and output filtering fail catastrophically under chain injection, often because each agent trusts the output of its peers.

Why This Matters for Developers

Multi-agent systems are rapidly moving from research projects into production — in code generation, customer support, and autonomous research. This paper is a timely reminder that security must be architected at the system level, not just bolted onto individual model calls. The authors suggest several promising directions: strict information-flow control between agents, verified provenance for each message, and “chaperone” agents that monitor for injection patterns across the swarm.

For now, the best defense is to treat every agent-to-agent channel as untrusted, and to limit the privileges of any single agent — especially the ability to execute code or access external APIs without human approval. The age of the lone‑model prompt injection is giving way to a more complex threat landscape, and the tools to defend against it are still being built.