MATS Research

Researchers show that a hierarchical system can be compromised even when its individual agents use CaMeL, because downstream agents can reinterpret untrusted data as trusted instructions. Their multi-CaMeL protocol preserves provenance between instruction and data channels and reports no successful control-flow attacks in its benchmark tests, averaged across five model backends with no data-flow security policies configured. The result is limited to the tested attacks and hierarchical setting, with implementation limitations and reduced task success relative to an undefended system.

MATS Research authors, one also affiliated with the UK AI Security Institute, evaluate distributed attacks in FakeLab, a synthetic lab codebase where agents work sequentially and monitors inspect individual commits. Splitting a shared attack reduces detection in tested settings, and an unmonitored explicit planner increases end-to-end attack completion as an upper bound on coordination. Results concern deliberately adversarial agents and selected monitor configurations, not observed collusion or measured deployment risk.