multi-CaMeL Defends Against Multi-Agent Indirect Prompt Injection

Researchers at the University of Oxford and other institutions found that deploying CaMeL protections for each agent individually is insufficient to ensure multi-agent system safety: untrusted data crossing agent boundaries is treated as trusted input by downstream agents, thereby hijacking their control flow. The authors call this failure mode boundary laundering and construct concrete attacks. To address this, they propose multi-CaMeL, which separates trusted natural language instructions from untrusted data into different channels in inter-agent communication and retains data provenance information at runtime. On the MultiAgentDojo benchmark, extended from AgentDojo, multi-CaMeL reduces the attack success rate from 12.9% with no protection and 0.2% with single-agent CaMeL to 0.0%; on AssetOpsBench, it adds only 3.2 percentage points of utility loss on average relative to single-agent CaMeL, and the loss decreases with stronger model capability. The authors also open-sourced MultiAgentDojo and the multi-CaMeL implementation.