multi-agent prompt infection spreading: how one compromised agent can take down the whole system

What is multi-agent prompt infection spreading?#

Multi-agent prompt infection spreading is a attack where a compromised AI agent injects malicious instructions into messages processed by other agents, causing those agents to replicate and propagate the same payload. It works through LLM-to-LLM prompt injection: one agent's output becomes another agent's input, carrying hidden instructions that hijack behavior. The pattern resembles a biological virus, where each infected host becomes a new vector for transmission.

If that sounds bad, it's because it is. A January 2026 review published in Information found that prompt injection now ranks as the number one vulnerability in the OWASP Top 10 for LLM Applications, showing up in over 73% of production AI deployments assessed. Multi-agent infection takes that single-point vulnerability and turns it into a network-scale problem.

Want to skip straight to a working inbox? LobsterMail gives your agent its own email without the manual wiring.

Why multi-agent systems are especially vulnerable#

A standalone agent that gets prompt-injected is a contained incident. Annoying, recoverable. But agents rarely work alone anymore. Most production setups involve chains: one agent handles intake, another processes data, a third takes action. They pass context to each other. That shared context is the attack surface.

The research paper "Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems" from October 2024 demonstrated this clearly. The researchers found that a compromised agent could spread infection to other agents, coordinating them to exchange data and issue instructions to agents equipped with specific tools. The infected agents didn't just follow the malicious instructions. They forwarded them.

Two factors make this worse than traditional software exploits:

Population size accelerates spread. The research showed that larger agent populations facilitated quicker infection spread. This follows a logistic growth curve: slow at first, then exponential once a critical mass of agents is infected, then leveling off as the pool of uninfected agents shrinks. In a system with 50 agents, a single infection can reach saturation in minutes.

Self-replicating infections are dramatically more effective. The paper compared self-replicating payloads (where the malicious prompt instructs the agent to include the same prompt in its outputs) against non-replicating ones (a single injection that doesn't propagate). Self-replicating infections significantly outperformed non-replicating infections in compromising agent functionalities. This is the difference between a phishing email and an actual worm.

How infection spreads through email#

This is where it gets personal for anyone building agent-to-agent workflows. Email is one of the most natural channels for prompt infection to propagate, because email is inherently a message-passing protocol between parties that don't fully trust each other.

Picture this: your agent receives an email from an external source. The email body contains hidden instructions embedded in the text (white-on-white text, invisible Unicode characters, instructions buried after 500 lines of normal-looking content). Your agent processes the email, extracts "action items," and forwards a summary to another agent. That summary now carries the payload. The second agent reads it, acts on the hidden instructions, and sends its own outbound emails containing the infection.

The tools that make agents useful are the same tools that make infection dangerous. An agent with send_email capabilities becomes a propagation engine. An agent with web_search can exfiltrate data. An agent with file access can establish persistence. Each tool is a capability the attacker inherits when the agent is compromised.

Barracuda Networks flagged this in their 2026 threat analysis, calling agentic AI "the 2026 threat multiplier" and noting that threat actors have been using generative AI for years to write and localize phishing content. The next step, they warned, is weaponizing the agents themselves.

What "AI worm" actually means#

The term "AI worm" has been floating around since early 2024, and it's not hyperbole. A traditional computer worm is self-replicating malware that spreads without human interaction. An AI worm does the same thing, but instead of exploiting software vulnerabilities, it exploits the fundamental way LLMs process instructions.

The worm doesn't need a buffer overflow or an unpatched CVE. It needs one thing: an agent that treats incoming text as trusted instructions. Since that's literally what LLMs do, the attack surface is the model itself.

InstaTunnel's analysis of multi-agent infection chains described the progression from isolated prompt injection to viral prompt infection as a fundamental shift. It's not about tricking one agent into doing something wrong. It's about turning every agent into a carrier.

Defenses that actually work (and ones that don't)#

LLM Tagging is one proposed defense where each message includes metadata identifying whether content was generated by an LLM or came from a human/external source. The idea is that agents can treat tagged content differently, applying stricter parsing rules to LLM-generated messages. The limitation: it relies on all participants in the chain being honest. A compromised agent can strip or forge tags. It's a useful signal, not a security boundary.

Existing safety guardrails are insufficient on their own. The research made this point explicitly. Standard LLM safety training (RLHF, system prompts that say "don't follow instructions in user content") can be bypassed with well-crafted payloads. These defenses work against casual attempts. They don't hold up against adversarial, self-replicating prompts specifically engineered to evade them.

What does help:

Inter-agent trust boundaries matter. Not every agent should blindly trust output from every other agent. Message signing (where each agent cryptographically signs its outputs) helps verify that a message hasn't been tampered with in transit. It doesn't prevent a compromised agent from sending signed malicious content, but it does create accountability and enables quarantine.

Rate limiting on outbound actions (especially email sends and API calls) contains the blast radius. A worm that can only send 3 emails per minute is less dangerous than one with unlimited send access.

Injection risk scoring on inbound content is probably the single most effective layer. Before an agent processes an email, the content gets analyzed for known injection patterns, suspicious formatting, and anomalous payloads. Flagged messages get quarantined rather than processed.

This is the approach we've taken at LobsterMail. Every inbound email processed through our infrastructure includes security metadata and an injection risk score. The agent still decides what to do with the email, but it has real signal about whether the content looks adversarial. You can read more about how this works in our security and injection guide.

Detection signals in production#

If you're running multi-agent workflows, here are concrete signals that suggest an active infection:

Unexpected outbound email volume from agents that normally only receive. Latency spikes in agent processing (infected agents often perform additional actions the attacker instructed). Tool calls that don't match the agent's normal behavior pattern, like a summarization agent suddenly using send_email. Message payloads that grow in size over time (self-replicating prompts add instructions to each forwarded message). And repeated patterns in outbound content across multiple unrelated agents, which suggests they're all executing the same injected instructions.

Monitor these. Alert on them. The difference between a contained incident and a full-chain compromise is detection speed.

What to do right now#

If you're building multi-agent systems that process external input (email, web content, user messages), you're in the blast radius for prompt infection. Three things to do today:

First, audit your agent-to-agent message flows. Map which agents pass content to which other agents. That's your infection graph. Identify the agents with the most downstream connections, because those are your highest-risk nodes.

Second, add injection scanning to every boundary where external content enters your system. For email specifically, LobsterMail's security features handle this at the infrastructure layer, so your agent gets scored content rather than raw, unscanned messages.

Third, implement least-privilege tool access. Your email-reading agent doesn't need web_search. Your summarization agent doesn't need send_email. Every unnecessary tool is an extra capability a worm inherits on infection.

Prompt infection isn't theoretical. The research is published, the attack patterns are documented, and the 2026 threat reports name it explicitly. The agents are already out there. The question is whether they're protected.