If every Agent is secure, why can the system still be breached? Cross-Agent trust laundering and dual-channel defenses
A paper from researchers at the University of Oxford and other institutions in October 2026 (arXiv:2610.05640) finds that even if every Agent in a multi-Agent system is deployed with CaMeL defenses, the system can still be breached by indirect prompt injection. Attackers exploit “Boundary Laundering,” causing data identified as untrusted to be executed downstream as trusted instructions after being passed across Agents; the paper demonstrates this process with a collaboration scenario involving three Agents: orchestration, SQL, and notification. The authors propose multi-CaMeL, which separates trusted instructions and data into two channels, message and variables, for transmission, and imposes instruction-channel integrity and cross-Agent provenance-preservation constraints. The authors also note that branch-guidance attacks do not violate their control-flow integrity definition, and that implicit data-dependency tracking still has limitations.
The original source uses attack cases involving three Agents and experimental figures to show that single-Agent protections are not automatically inherited by multi-Agent systems; the dual-channel and provenance-preserving design can serve as a reference for multi-agent teams.