Research · curated 22 Sep 2026
Beyond Single-Model Injection: A Threat Model and Defense Architecturefor Prompt Injection in Multi-Agent Systems
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Multi-agent prompt injection exploits inter-agent trust and shared tool access that perimeter defenses cannot see, and this work gives defenders both a threat taxonomy and measured architectural mitigations for agentic deployments.
A research paper by Rudrendu Kumar Paul and Sourav Nandy proposes a threat model enumerating 14 prompt-injection attack vectors across four categories (direct, indirect via tool outputs, inter-agent message passing, and cascading orchestrator manipulation) specific to multi-agent LLM systems. Testing against a 6-agent production-representative system found 67% of agents vulnerable to at least one scope violation and 43% success for indirect injection via tool outputs, while four architectural defenses (message signing, boundary sanitization, privilege-scoped tool access, and anomaly detection) reduced overall injection success from 31.2% to 4.2%.