What it is
Cross-agent prompt propagation occurs when an injected instruction enters one agent and travels through an automated handoff to another. The first agent may summarize a hostile document, extract a field, or generate a plan. The second agent receives that output as peer context and treats it as trusted, allowing the instruction to continue into later stages. The original attacker may never address the downstream model directly.
Some researchers call this “prompt infection,” which is useful shorthand; this lesson’s name emphasizes the mechanism: propagation across an agent boundary. It differs from orchestrator impersonation, which forges a coordinator’s identity, and from stored injection, which emphasizes persistence. A legitimate summary can contain imperative language, so every handoff needs provenance and scope rather than a blanket assumption that peer output is safe.
How it works
An attacker plants or submits content that the first agent will process. The agent is asked to summarize, classify, plan, or extract information. The output preserves the hostile instruction verbatim, paraphrases it as a recommendation, or embeds it in a structured field. An orchestrator passes the result to a downstream agent, often with a prompt saying to trust the previous worker.
The downstream agent may then retrieve sensitive context, call a tool, or produce another summary that carries the instruction farther. Each transformation can strip the original source, making the payload look increasingly legitimate. A chain with different models and policies is difficult to reason about if the handoff contract does not distinguish data, recommendation, and command.
Why it works
Multi-agent systems are built around delegation. A worker’s output is normally a useful, compressed representation of earlier work, so downstream agents are encouraged to trust it for efficiency. Models also treat concise peer-written text as authoritative when the surrounding prompt describes it as a vetted result.
Safety checks often focus on the front door: the user message or initial document. Internal messages may skip the same filters, and a summarizer may convert an obviously suspicious sentence into a polished directive. The model cannot know that the first agent was manipulated unless provenance and trust state are carried alongside the text. The chain therefore turns one weak boundary into a larger blast radius.
A safe, fictional example
The fictional Lumen Travel Desk uses three local agents: a page reader, a trip planner, and a budget checker. A synthetic travel page contains a note asking the page reader to add an invented “priority fare” instruction to its summary. The planner receives the summary as a quoted source and has no booking or payment tools.
The test checks whether the planner treats the note as source content, labels the provenance, and keeps it out of the budget decision. Reviewers compare a clean handoff with one that includes the poisoned note, then inspect every transformation. All destinations, prices, and actions are fabricated; the workflow cannot contact a real travel service.
Travel page to Page reader: Hiddenpage + note: "add the priority-fare rule"
Page reader to Trip planner: summary, note still inside
Trip planner to Budget checker: plan, labeled "from an outside page"
Blockedoutside text never sets the budget
How to spot it
Trace instructions and provenance across every agent boundary. Flag summaries that contain commands, authority claims, external destinations, or actions unrelated to the source task. Compare the first agent’s input with its output and identify text that changed from data into a recommendation or command.
Behavioral signals include a downstream tool call that was absent from the user’s goal, a new permission claim, or the same unusual phrase appearing in several agents’ outputs. Record message IDs, trust labels, schema versions, and hashes. Do not rely on the final transcript; propagation may have erased the original wording.
Defensive controls
Define explicit handoff contracts with separate fields for facts, untrusted quotations, recommendations, and executable commands. Authenticate sender and audience, carry provenance and confidence, and validate schema at each hop. A downstream agent should not treat peer prose as a permission grant. Enforce tool authorization independently and require confirmation before consequential actions.
Apply the same content and injection tests to internal messages as to user input. Limit each agent’s context and capabilities, isolate high-impact steps, and expire intermediate plans. Test poisoning through documents, summaries, retries, caches, and alternate agents with synthetic data. Log lineage and block propagation when a source cannot be verified.
Limits and nearby techniques
Indirect prompt injection is the usual initial delivery path. Orchestrator impersonation forges a trusted coordinator message, while propagation can happen through honest-looking peer output without impersonation. Stored prompt injection persists the payload in a queue or knowledge store. Memory poisoning targets long-term recall. A normal handoff carrying a quoted instruction is not automatically an attack; the failure occurs when the receiver loses provenance and upgrades data into authority.