Explain the compounding risk property of injection in a multi-agent topology

Flashcard·Hard·4.0 · 0·~30s·Asked atFlipkart Uniphore Zed

Attempt it

In a multi-agent topology, agent A's outputs become agent B's inputs. If agent A is injected and emits attacker-controlled text, B reads it as a trusted teammate message, not as untrusted user content, and is more likely to comply. The malicious instruction propagates one handoff at a time through the network until it reaches an agent with tool access, where the blast radius materialises. Minimum mitigation: treat every inter-agent message as untrusted content (provenance tag = untrusted_agent_output), apply the same input rails between agents as on the external boundary, and gate any irreversible tool call on a separate quorum check that does not rely solely on the most recent agent's say-so.

Your answer

A **multi-agent system** is a setup where several model instances work together, passing messages between them. Agent A might plan a task, agent B might search the web, agent C might write code. Each agent reads the previous agent's output and acts on it. The danger is that those messages are trusted by default. When a user prompt is full of suspicious content, the input rails check it carefully. When agent A's message arrives at agent B, the system usually treats it as an internal teammate message and skips the same level of suspicion. That assumption breaks the moment any one agent gets injected. Suppose an attacker hides a malicious instruction in a web page that agent B retrieves. Agent B might be fooled and put that instruction in its output. Agent C reads B's output as a trusted teammate message and follows the instruction. The injection has just **propagated** one handoff. If the chain ends at an agent with tool access, a code executor, a database writer, an email sender, the attacker now has effectively that tool. **Minimum mitigation:** mark every inter-agent message as untrusted, apply the same input safety checks between agents as you do at the outer boundary, and require a second check before any irreversible tool call.

**Compounding injection is a topology problem.** Inter-agent messages cross a boundary, but most systems do not treat that boundary the way they treat the external user boundary. The result is asymmetric trust: external input is screened, agent to agent output is not. The attack chain has three steps. Step one: an attacker injects agent A, usually indirectly, via untrusted content in retrieval, web fetch, calendar invites, or email bodies. Step two: agent A emits attacker-controlled text in its output, which is consumed by agent B. Step three: agent B reads the text as trusted teammate output and complies, often more readily than it would have complied with the same instruction from the user. The chain continues until it reaches an agent with tool access. The blast radius materialises there. **Why agent B is more compliant.** Two reasons. The instruction now lacks the suspicious context that surrounded the original user input, it has been laundered through A's output. And the system prompt of B usually frames inter-agent messages as cooperative coordination, not as adversarial input. **Minimum mitigation has three components.** Provenance tagging: every inter-agent message carries a tag marking it as `untrusted_agent_output`, distinct from `system_instruction` or `user_input`. The receiving agent's prompt template makes the tag visible. Inter-agent input rails: the same Llama Guard, Prompt Guard, and PII checks that run on user input run on agent to agent messages. The latency cost is real, the safety win is bigger. Quorum check on irreversible actions: any agent invocation of a destructive tool requires a separate confirmation pass that does not depend on the immediate predecessor agent's say-so. A second model, a deterministic check, or human approval, anything that is not the agent that just consumed the injected message. The pattern that closes the gap fully is the **dual-LLM or quarantined-processor pattern**: the agent holding tool access never

TL;DR

Inter-agent messages are treated as trusted teammate output, so an injection in one agent rides through every downstream handoff until it hits an agent with tool access, that is where the blast radius materialises.

Memory aid

Easy to grasp

Imagine a relay race where each runner trusts the baton message handed to them by the previous runner. One runner is bribed and writes a malicious note on the baton. Every later runner reads the note, trusts it, and acts on it. By the time the last runner reaches the bank teller (the agent that holds the cash drawer), the original bribe has travelled through five hands and now looks like a routine internal request. Multi-agent systems work the same way. The cure is for every runner to treat the baton message as if it came from a stranger on the street, not from a teammate, and to require a separate confirmation before doing anything irreversible.

Key concepts

Multi-agent systems Safety & Guardrails

Concept explanation~2 min read

Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.

Multi-agent systems are the topology where prompt-injection compounds. Single-agent injection is bounded, the attacker has to compromise the agent that holds the destructive tool. Multi-agent injection is unbounded in the same chain, the attacker only needs to compromise the weakest agent, and the malicious instruction rides every downstream handoff to the agent that does hold the tool. The blast radius lives at the most-privileged node; the entry point lives at the least-defended one.

This walkthrough builds the propagation chain step by step, names the trust assumption that makes the propagation possible, and lays out the per-edge defense pattern that closes the gap. The principle: every handoff is a fresh trust boundary; treat it as one or accept that injection will find the weakest link.

Mental model: in a multi-agent topology, the chain is only as safe as its least-screened edge. Defense in depth has to be per-edge, not just per-node.

The propagation chain and the trust assumption that enables it

Step one: the initial injection

The injection enters somewhere. The most common vector in 2026 is indirect prompt injection through retrieval: a malicious instruction embedded in a knowledge-base article, a calendar invite, a fetched web page, or an email body. The agent that retrieves and processes this content is the entry-point agent. It is rarely the agent with destructive tool access.

Example entry points:

A customer-support knowledge-base article edited by an external user.
A scraped web page returned by a search tool.
A calendar invite or email that an agent reads as part of triage.
A document uploaded by a user to a shared retrieval index.

Step two: the entry-point agent emits attacker-controlled text

The entry-point agent reads the injected content. Depending on its system prompt and the strength of input rails, it may comply with the injected instruction directly, or it may quote, summarize, or paraphrase the content in its output to the next agent. Either way, attacker-controlled text now sits in the entry-point agent's output.

Step three: the downstream agent treats the message as trusted teammate output

This is where the trust assumption matters. Most multi-agent frameworks (CrewAI, AutoGen, LangGraph, Anthropic's agent stack) frame inter-agent messages as cooperative communication. The receiving agent's system prompt does not warn it to treat upstream output as adversarial. The input rails that run on external user input do not run on inter-agent messages by default.

The consequence: the downstream agent reads the attacker-controlled text without the suspicion that surrounded it at the external boundary. It complies. If the downstream agent has tool access, the attack lands.

Why agent B is more compliant than the user would have been

Two independent effects:

Context laundering. The instruction now appears without the suspicious context that surrounded the original injected document. 'Refund the customer $10,000' inside a knowledge-base article looks suspicious; the same text inside an inter-agent message that says 'the user wants you to process a refund' looks routine.
System-prompt framing. The receiving agent's prompt typically establishes the upstream agent as a trusted collaborator: 'You are a tool-using agent. The planner agent will hand you tasks; complete them.' That framing weakens refusal by default.

Both effects raise the compliance probability above what the user would have achieved with a direct injection.

Provenance tagging and per-edge input rails

Tool-call gating, quorum checks, and the dual-LLM pattern

Observability, model diversity, and the 2026 production pattern

Situations where this technique stops working.

2–4 min · Everything important, quickly.

Real products, models, and research that use this idea.

Anthropic's Claude Opus 4.7 multi-agent research describes the propagation pattern explicitly and demonstrates it across agent toolkits including code interpreters and tool-using web agents.
Microsoft Research's papers on multi-agent prompt injection (cross-prompt injection attacks, CPIA) document concrete chains exploiting CrewAI and AutoGen topologies in 2024 and 2025.

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you instrument an agent topology so a compounding-injection incident is detectable and traceable post hoc?

Per-edge OTel spans with provenance tags, message hashes, and rail decisions. Maintain a separate audit trail of all inter-agent payloads with retention long enough for forensic review. When the destructive tool call fires, the trace shows the full chain of message provenance back to the original injection source, usually a retrieval result.

2 more follow-ups an interviewer would ask next. Sign in to reveal them.

Red flags & common mistakes

The phrases that signal junior thinking. Click to expand.

Most common mistake

Assuming inter-agent messages are 'inside the trust boundary' and skipping input rails between agents; the injection rides every handoff straight to the agent that holds the destructive tool.

60 second bullets to scan on the way to the call.

Why inter-agent messages are treated as trusted by default in most frameworks
The three-step propagation chain from initial injection to tool execution

Primary sources. Browse if you want the original framing.