Inter-agent prompt injection is an attack where one AI agent manipulates another agent through crafted prompts, hidden instructions, or contaminated context. In practice, a compromised or malicious agent can steer tool use, leak data, or override policy in multi-agent systems, especially when shared memory, messages, or MCP-connected workflows are trusted without validation.
How Inter-Agent Prompt Injection Works
Inter-agent prompt injection exploits the fact that one agent can treat another agent’s messages, summaries, memory, or tool outputs as instruction-like input. The attacker does not need to break the model itself; they only need to place malicious guidance where the receiving agent is likely to trust it.
This is especially dangerous in multi-agent systems because the attack path can be indirect and delayed. A poisoned message may look like routine coordination data, but it can quietly reshape later decisions, override policy, or redirect the next tool action.
Why It Becomes Dangerous in Multi-Agent Systems
The core hazard is misplaced trust between agents. When a worker agent, orchestrator, or shared context store accepts content without clear provenance checks, prompt contamination can move laterally across the system and turn one compromised interaction into a broader control failure.
That failure is amplified when agents have access to email, tickets, files, browsers, code, or MCP-connected tools. In that setting, injected instructions can influence not just what the model says, but what it reads, writes, sends, or executes on behalf of the environment.
For a practical reference point on the attack shape, NHIMG’s Prompt Injection Guide covers direct, indirect, and multimodal injection patterns and the defensive principle of not treating untrusted content as instructions.
Common Attack Paths and Failure Conditions
Inter-agent prompt injection usually appears through shared memory, message passing, retrieved context, tool outputs, or agent-to-agent coordination channels. A compromised upstream agent can plant hidden instructions that survive normal summarisation and are later reinterpreted as legitimate task context.
The failure conditions are predictable: weak message validation, no provenance labeling, overbroad tool permissions, and systems that let one agent inherit another agent’s assumptions. Once that happens, the injected content can trigger tool misuse, sensitive data exposure, or policy bypass without any obvious user-facing anomaly.
NHIMG’s Multi-Agent and A2A Security Guide is useful where the real issue is trust between agents, signed coordination, and containment across multi-hop delegation paths.
How Defenders Should Think About It
Defence starts by treating inter-agent messages as untrusted inputs rather than internal truth. Systems need explicit separation between instructions, data, and tool output, plus strong controls over what one agent is allowed to pass to another.
That also means reducing the blast radius of any single agent. If an agent can only act within narrow scopes, and if sensitive actions require explicit confirmation or a separate policy decision, injected guidance has far less room to become a harmful action.
For readers building or evaluating agent controls, the Agentic AI Security Guide provides the broader control model for inputs, memory, tools, orchestration, and identity that this attack class depends on.
Risk and Threat Considerations
Inter-agent prompt injection creates a trust-boundary problem: once one agent can influence another through shared context, a single compromise can spread into tool misuse, data leakage, or policy override. The risk is highest in systems that reuse memory or coordinate through loosely validated messages.
Failure mechanism: Malicious instructions ride inside apparently normal agent traffic, survive retrieval or summarisation, and are executed because the receiving agent cannot reliably distinguish task data from attacker-supplied control text.
Impact: Attackers can steer downstream reasoning, exfiltrate secrets or records, trigger unauthorized tool actions, and create cascading compromise across multiple agents or workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Inter-agent injection often seeks to redirect agent tool use. |
| ASI03 — Identity & Privilege Abuse | The attack works by abusing delegated agent authority and trust. | |
| ASI07 — Insecure Inter-Agent Communication | The term directly concerns compromised agent-to-agent message trust. | |
| Recommendation — Constrain tool invocation so injected instructions cannot trigger unsafe actions. Limit delegated privileges and require policy checks before agent actions. Authenticate and validate inter-agent messages before accepting instructions or context. | ||
| MITRE ATLAS | Adversarial AI Techniques | Prompt injection and context poisoning are core adversarial AI behaviors. |
| Recommendation — Map injection paths to adversarial AI techniques and test them in red-team exercises. | ||
Practitioner Guidance
Why practitioners should care: This term is not just about model behavior, it is about control of delegated action. If agents can pass context to one another, then trust, authorization, and containment all become part of the security boundary.
Practitioner note: The safest mental model is to treat inter-agent communication the same way you treat any other untrusted external input. The agent may be internal, but the content it forwards may not be trustworthy.
NHIMG’s AI Agent Authorisation Guide is the right companion where the question becomes how to scope agent authority and constrain per-action privilege.