A prompt injection can be written so that every agent it reaches passes it on. Research on multi-agent systems documents an attack the authors call Prompt Infection, in which a payload hijacks one agent, executes role-specific instructions there, and replicates itself into the messages that agent sends to others. The finding that inverts the usual intuition: a stronger model resists infection better but executes the attack more effectively once compromised.
Key facts
- The paper is Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems, arXiv 2410.07283.
- The attack has four defined components: prompt hijacking, a payload, data, and self-replication.
- The authors report that GPT-4o was more resistant to infection than GPT-3.5 but more effective at executing the attack once compromised.
- The paper demonstrates propagation within a run and manipulation of a memory-importance score. It does not demonstrate cross-session persistence or any change to model weights.
Ordinary prompt injection is a one-shot problem: hostile text lands in a model's context and the model follows it instead of its operator. The failure is contained to that one call. What makes this different is the replication component. The injected instructions include an instruction to include the injected instructions in whatever the agent sends next.
Because agents communicate by writing text to each other, and because a receiving agent has no way to distinguish an instruction its teammate meant to send from an instruction its teammate was tricked into forwarding, the payload rides normal traffic. The paper's own figure describes the first compromised agent extracting and propagating the infection prompt, with downstream agents executing role-specific instructions while continuing to pass the prompt along.
It is the mechanism of a chain letter, not a virus in the biological sense. Nothing is installed. Each recipient is simply persuaded to send the same message onward, and the message is persuasive because it arrives from a trusted colleague.
The capability inversion is the result worth remembering. Intuition says a better model is a safer model, and for the initial compromise that held: GPT-4o was harder to hijack than GPT-3.5. But once the payload was in, the more capable model was better at carrying out whatever the payload asked, for exactly the reason it is more useful in general. Capability is not a defense; it is an amplifier pointed wherever the instructions point. That is worth sitting with when planning an agent deployment, because it means upgrading the model reduces the probability of compromise while raising the severity of one.
The authors also studied persistence, and here it is important to be precise about what they showed. In a society-of-agents setup where memory is not explicitly shared between agents, the infection has to spread hop by hop rather than appearing everywhere at once. Within that setup, the researchers found the payload could inflate the importance score that governs which memories get retrieved, effectively promoting itself in the queue so it keeps resurfacing. That is persistence within a run, achieved by gaming a ranking function. There is no experiment in the paper that resets the conversation and checks whether the payload survives, and there is nothing about weight updates or learned belief. Claims that agents permanently adopt an injected belief go beyond this work.
The reason to revisit this mechanism now is that the deployment pattern it assumes has become the default. Agent frameworks routinely run several specialized agents that hand work to each other, and the shared artifacts they exchange are increasingly downloadable. Research published this week on why agent skills work shows those skill files function as procedural instructions the agent follows without much scrutiny, which is a precise description of an injection target. GitHub's own documentation, which we noted when agent skills became a package format, warns that third-party skills may contain prompt injections, hidden instructions, or malicious scripts.
We have also seen the multi-agent surface behave in unexpected ways in other work: teams of aligned agents came out less aligned than any one of them, which is a different failure but points at the same blind spot, that properties verified on a single agent do not automatically hold for a group.
The honest caveat is age and scope. This is a preprint studying a constructed multi-agent setup with a specific message-passing topology, and the models tested are a generation behind current frontier systems. The mechanism does not depend on model generation, but the specific resistance rates certainly do, and nobody should quote a two-year-old compromise rate as a current one. There is also no evidence in the paper of this attack occurring in the wild.
The defensive implication is structural rather than a patch. If an agent cannot distinguish instructions from data in a teammate's message, then no amount of hardening the individual model fixes the topology. The controls that actually apply are at the boundary: sandboxing agents, constraining what each one is permitted to do regardless of what it is told, and treating inter-agent messages as untrusted input the same way you would treat a web page. Our lesson on multi-agent systems covers why these architectures are attractive despite this.
Originally published on Ground Truth, where every claim is checked against the primary source.
