Research · curated 17 Sep 2026
The Confused Deputy in the Swarm: Cascading Privilege Escalation and Memory Poisoning in Multi-agent LLMs by Ashish Vishwakarma :: SSRN
First reported ssrn.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Multi-agent LLM systems with heterogeneous privilege levels are increasingly deployed, and this research shows how indirect prompt injection can cascade and amplify through inter-agent channels and poisoned memory, pointing defenders toward deterministic policy firewalls over prompt-level mitigations.
An empirical laboratory study by Ashish Vishwakarma investigates two attack vectors in multi-agent LLM swarms: cascading privilege escalation across inter-process communication and latent memory poisoning within RAG vector stores. Using open-weights models (SmolLM2-135M, Qwen2.5, Llama-3.1-8B), the paper demonstrates that subordinate worker agents concentrate indirect prompt injections rather than diluting them, driving escalation rates up to 65% and memory-triggered reasoning drift up to 75%, while deterministic non-LLM policy firewalls eliminate escalation.