{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/multi-camel-cross-agent-trust-boundaries-2026/",
 "asOf": "2026-10-30",
 "id": "multi-camel-cross-agent-trust-boundaries-2026",
 "date": "2026-10-05",
 "datePrecision": "day",
 "title": "Multi-CaMeL preserves trust boundaries between agents, with utility costs",
 "lane": "defense",
 "kind": "paper",
 "summary": "Researchers show that a hierarchical system can be compromised even when its individual agents use CaMeL, because downstream agents can reinterpret untrusted data as trusted instructions. Their multi-CaMeL protocol preserves provenance between instruction and data channels and reports no successful control-flow attacks in its benchmark tests, averaged across five model backends with no data-flow security policies configured. The result is limited to the tested attacks and hierarchical setting, with implementation limitations and reduced task success relative to an undefended system.",
 "whyItMatters": "It tests whether a defense for one agent remains effective when that agent delegates work to another.",
 "actors": [
  "university-of-oxford",
  "mats-research",
  "ai-sequrity"
 ],
 "topics": [
  "multi-agent-security",
  "prompt-injection",
  "access-controls"
 ],
 "atlas": [
  "other-agents",
  "untrusted-content",
  "tools"
 ],
 "artifacts": [
  "camel",
  "agentdojo",
  "claude-fable-5",
  "gpt-5-family",
  "gpt-4-family",
  "gemini"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2610.05640v1",
   "publisher": "arXiv",
   "title": "Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks",
   "date": "2026-10-05",
   "type": "primary",
   "accessed": "2026-10-13"
  }
 ],
 "keyFacts": [
  {
   "fact": "The demonstrated failure occurs when untrusted upstream data crosses an agent boundary and becomes trusted downstream input, despite each constituent agent using CaMeL. Multi-CaMeL passes trusted instructions separately from untrusted data and preserves provenance.",
   "locator": "Abstract; Sections III–IV"
  },
  {
   "fact": "On MultiAgentDojo, attack success averages 0.0% for multi-CaMeL, 0.2% for individual-agent CaMeL and 12.9% without CaMeL across five backends: Claude Fable 5, GPT-5.5, GPT-4.1, Gemini 2.5 Pro and Gemini 2.5 Flash Lite, with 949 injected instances per backend and configuration. Undefended rates vary from 0.0% to 36.1%; the authors caution that GPT-5.5’s zero does not establish robustness.",
   "locator": "Abstract; MultiAgentDojo evaluation"
  },
  {
   "fact": "The main AssetOpsBench utility comparison excludes 29 tasks judged impossible as specified, retaining 112 tasks; it reports the all-task comparison separately. Multi-CaMeL reduces utility relative to no CaMeL, with variation across model backends.",
   "locator": "Section V-A; Figure 5; Appendix B"
  },
  {
   "fact": "The hierarchical agent-as-tool experiments configure no data-flow security policies, so they test control-flow integrity, not data-policy enforcement. The implementation inherits incomplete implicit-dependency tracking from CaMeL, and broader confinement remains future work. Claude Fable 5 refused 52 of 97 benign MultiAgentDojo tasks; utility is reported with and without those refusals.",
   "locator": "Discussion; Conclusion"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-087"
 ],
 "methods": [
  "control-data-isolation",
  "provenance-controls",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-13",
 "revisions": []
}