Study reveals boundary laundering attacks in multi-Agent systems and proposes multi-CaMeL

A paper from researchers at the University of Oxford and other institutions in October 2026 (arXiv:2610.05640) finds that even if every Agent in a multi-Agent system is deployed with CaMeL defenses, the system can still be breached by indirect prompt injection. Attackers exploit “Boundary Laundering,” causing data identified as untrusted to be executed downstream as trusted instructions after being passed across Agents; the paper demonstrates this process with a collaboration scenario involving three Agents: orchestration, SQL, and notification. The authors propose multi-CaMeL, which separates trusted instructions and data into two channels, message and variables, for transmission, and imposes instruction-channel integrity and cross-Agent provenance-preservation constraints. The authors also note that branch-guidance attacks do not violate their control-flow integrity definition, and that implicit data-dependency tracking still has limitations.