Findings/injections-propagate-between-agents

A single malicious message can spread on its own across networks of connected agents.

Corroboratedmeasured2 evidence records from 2 independent sourcesassistant-drafted

Scope: what this does not show

Laboratory settings and one platform red-team; no in-the-wild propagation recorded.

Corroborated: Supported by at least two independent sources.

Evidence

Mar 5, 2024

Morris II paper demonstrates self-replicating prompts spreading between GenAI email assistants

arXiv

Apr 30, 2026

Microsoft Research red-teams a network of 100+ agents and finds propagation and trust-capture failures

Microsoft Research

Relaying agents also hid the attacker's identity during exfiltration.

Status history

2024-03-05ReportedMorris II: a self-replicating prompt spreads across email assistants in a lab. · record
2026-04-30CorroboratedMicrosoft red team shows propagation across a multi-agent platform. · record

What would change this: Multi-agent platforms that contain a compromised agent without stalling useful work.
Evidence kind: measured: An experiment or evaluation produced the number.
Freshness: Evidence 149d old · recheck in 391 daysNewest evidence Apr 30, 2026. Half-life 540 days.
Methods tested: Propagation between agents Indirect prompt injection
Topics: Multi-agent security Prompt injection
Attack surface: Other agents
Fide research: FID-087: Collective resilience in autonomous cyber defense

Cite this record

Fide AI. "A single malicious message can spread on its own across networks of connected agents.." Agentic Cyber Explorer, record injections-propagate-between-agents. https://agentic-cyber-explorer.pages.dev/findings/injections-propagate-between-agents/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-injections-propagate-between-agents,
  author = {{Fide AI}},
  title = {A single malicious message can spread on its own across networks of connected agents.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/injections-propagate-between-agents/},
  note = {Record injections-propagate-between-agents; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.