Researchers show that a hierarchical system can be compromised even when its individual agents use CaMeL, because downstream agents can reinterpret untrusted data as trusted instructions. Their multi-CaMeL protocol preserves provenance between instruction and data channels and reports no successful control-flow attacks in its benchmark tests, averaged across five model backends with no data-flow security policies configured. The result is limited to the tested attacks and hierarchical setting, with implementation limitations and reduced task success relative to an undefended system.
Why it matters
It tests whether a defense for one agent remains effective when that agent delegates work to another.
Key facts
As stated in the sources, with where to find them.
- The demonstrated failure occurs when untrusted upstream data crosses an agent boundary and becomes trusted downstream input, despite each constituent agent using CaMeL. Multi-CaMeL passes trusted instructions separately from untrusted data and preserves provenance.Abstract; Sections III–IV
- On MultiAgentDojo, attack success averages 0.0% for multi-CaMeL, 0.2% for individual-agent CaMeL and 12.9% without CaMeL across five backends: Claude Fable 5, GPT-5.5, GPT-4.1, Gemini 2.5 Pro and Gemini 2.5 Flash Lite, with 949 injected instances per backend and configuration. Undefended rates vary from 0.0% to 36.1%; the authors caution that GPT-5.5’s zero does not establish robustness.Abstract; MultiAgentDojo evaluation
- The main AssetOpsBench utility comparison excludes 29 tasks judged impossible as specified, retaining 112 tasks; it reports the all-task comparison separately. Multi-CaMeL reduces utility relative to no CaMeL, with variation across model backends.Section V-A; Figure 5; Appendix B
- The hierarchical agent-as-tool experiments configure no data-flow security policies, so they test control-flow integrity, not data-policy enforcement. The implementation inherits incomplete implicit-dependency tracking from CaMeL, and broader confinement remains future work. Claude Fable 5 refused 52 of 97 benign MultiAgentDojo tasks; utility is reported with and without those refusals.Discussion; Conclusion
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Bounding what untrusted input can trigger helps, but trust boundaries must survive delegation and tool execution.
Sources
Related records
Sep 29, 2026
Oct 16, 2026
Sep 29, 2026
Sep 28, 2026
Oct 4, 2026
Sep 30, 2026