Individual CaMeL agents distinguish trusted instructions from untrusted data, but the October 5 study found that this protection does not automatically compose when one protected agent calls another. An attack succeeded when material treated as untrusted in one component became trusted input in the next. The proposed multi-CaMeL protocol separates trusted…
Inspect the ClaimsCase · DiggingBeagle record
CaMeL-protected agents lost prompt-injection provenance when delegating to each other
A preprint reported a prompt-injection chain that succeeded despite every participating agent enforcing CaMeL locally, then evaluated a provenance-preserving communication protocol.
Scope
Controlled hierarchical multi-agent experiments and the MultiAgentDojo benchmark described in arXiv:2610.05640, not a documented field intrusion.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The paper demonstrates a cross-agent trust-label failure and reports 0.0%, 0.2%, 12.9% benchmark attack-success rates. Multi-CaMeL is a published research proposal evaluated in MultiAgentDojo, not a verified deployed fix or proof of general invulnerability.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MC-COMPOSITION-FAIL · CLM-MC-BENCHMARK-ASR · CLM-MC-UTILITY · Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks
At a glance
The vulnerable transition is not one agent ignoring its own labels; it is an agent-to-agent message channel losing those labels. Passing untrusted content through a separate data channel and preserving provenance changes this hand-off boundary. The paper also measures a task-utility cost and does not establish safety for untested agent frameworks, models or…
Read the implicationsIndependent replication using production multi-agent frameworks and MCP bridges. Sensitivity of the result to models, attack budget and communication topology. Deployment complexity and runtime costs outside the paper’s benchmark.
Limits and uncertaintyFull account
Individual CaMeL agents distinguish trusted instructions from untrusted data, but the October 5 study found that this protection does not automatically compose when one protected agent calls another. An attack succeeded when material treated as untrusted in one component became trusted input in the next. The proposed multi-CaMeL protocol separates trusted natural-language instructions from a distinct data channel, carrying provenance across agent delegation boundaries. On the authors’ MultiAgentDojo benchmark, reported attack success was 0.0% with multi-CaMeL, 0.2% with individual CaMeL and 12.9% with no CaMeL. The numbers are benchmark-specific, with a measured utility trade-off; they are not a security certificate for real installations.
Mechanism and trust boundary
- 01
Untrusted content
Attacker-controlled material enters the first agent as data.
Boundary: External content to locally protected agent
- 02
Agent delegation
Data is passed to a second protected agent without a preserved untrusted classification and is treated as instructions.
Boundary: Source agent data classification to recipient agent authority
Claims & evidence
CLM-MC-UTILITYThe paper reports a utility cost for provenance-preserving communication, with a smaller relative cost for stronger models in its tested configurations.supported
Basis: reported finding
- supportsCan CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacksprimary disclosure
Abstract, security-utility trade-off
CLM-MC-BENCHMARK-ASRIn the authors’ MultiAgentDojo evaluation, multi-CaMeL achieved 0.0% attack success versus 0.2% for individual-agent CaMeL and 12.9% for no CaMeL.supported
Basis: reported finding
- supportsCan CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacksprimary disclosure
Abstract, evaluation results
CLM-MC-COMPOSITION-FAILThe authors report a constructed prompt injection that succeeds when independently CaMeL-protected agents delegate and a downstream agent promotes earlier untrusted information into trusted input.supported
Basis: reported finding
- supportsCan CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacksprimary disclosure
Abstract, sentences describing failure of composition
Implications
The vulnerable transition is not one agent ignoring its own labels; it is an agent-to-agent message channel losing those labels. Passing untrusted content through a separate data channel and preserving provenance changes this hand-off boundary. The paper also measures a task-utility cost and does not establish safety for untested agent frameworks, models or production tools.
Unknowns and contradictions
- Independent replication using production multi-agent frameworks and MCP bridges.
- Sensitivity of the result to models, attack budget and communication topology.
- Deployment complexity and runtime costs outside the paper’s benchmark.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123