Multi-hop injection is an attack that reaches a target in several steps, rather than with one direct prompt or payload. An initial instruction can be embedded in one tool output, web page, file, or message, then carried forward through intermediate system hops until an agent or model executes it.
What Multi-Hop Injection Means in Practice
Multi-hop injection is dangerous because the malicious instruction does not need to survive intact in one place, it only needs to be preserved, reformatted, or re-expressed as it passes through the system. That makes the attack harder to spot than a single obvious payload.
The key idea is propagation across trust boundaries. One component may ingest untrusted content from a file, web page, message, or tool output, then pass a transformed version to the next component, where the embedded instruction becomes operational.
That chaining effect is especially relevant when an application trusts intermediate outputs too much. A model may summarize, normalize, translate, or extract content in a way that accidentally carries the attacker’s instruction forward instead of stripping it.
How Multi-Hop Injection Survives Intermediate Systems
The attack often works because each hop sees only a small part of the full context. No single step may look dangerous on its own, but the combined path can reassemble the malicious instruction into something the final agent or model follows.
This makes the problem broader than prompt filtering at the input boundary. If a tool, connector, retrieval layer, or agent chain can reintroduce attacker-controlled text into later reasoning, the system can still be steered even after an apparently safe first pass.
It also means defenders have to think about provenance, not just content. An instruction that originated in user input, web content, or a previous tool response should not gain trust simply because it has been copied into a later internal message.
For adjacent defensive guidance on direct and indirect prompt injection, Prompt Injection Guide covers the core attack patterns that often become the first hop in a multi-step chain.
Why Multi-Hop Injection Is Hard to Detect
The main detection problem is that the malicious payload may never appear as an obvious end-to-end string. It can be split, paraphrased, translated, extracted from markup, or embedded in intermediate reasoning artifacts that look benign in isolation.
That creates a blind spot for simple keyword filters and one-pass scanners. Defenders need to inspect the whole propagation path, including tool outputs, retrieved documents, message history, and any internal representations that are later reused as context.
Multi-hop injection is also closely related to agentic workflows, where one component hands off work to another. In those environments, a compromised intermediate step can become a relay for a later execution decision even if the final model never directly consumed the original source.
Multi-Agent and A2A Security Guide is useful here because it explains how delegation chains and inter-agent trust can carry harmful instructions across multiple steps.
Defensive Controls for Multi-Hop Injection
Defence starts with strict separation between untrusted content and executable instructions. Systems should preserve source boundaries, label provenance, and avoid allowing retrieved or forwarded text to compete with policy, system, or operator instructions.
Another useful control is containment around tool output. If a tool returns text that will later be fed into another model or agent, that output should be treated as data, not authority, unless the workflow explicitly validates and sanitises it first.
Teams should also reduce the number of places where attacker-controlled text can be reintroduced into the chain. The more hops a payload can survive, the more chances it has to be reformatted into something that looks trustworthy.
For a broader defensive treatment of hidden instruction paths and exfiltration channels, the Prompt Injection Guide is the best companion reference for understanding how initial payloads are shaped and preserved.
Risk and Threat Considerations
Multi-hop injection increases the chance that a malicious instruction will evade a single control point and reach execution through normal system flow. The risk is highest when agents, retrieval layers, and tools repeatedly transform the same untrusted content without strong provenance checks.
Failure mechanism: An attacker places a hidden instruction in one hop, then relies on summarisation, translation, extraction, or delegation to preserve the instruction until a later component treats it as trusted context.
Impact: The final agent may leak data, misuse tools, alter decisions, or continue the chain by forwarding the payload to yet another system, turning one injection into a broader compromise path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V8 — Authorization | Multi-hop injection can cause unauthorized actions through coerced model or agent decisions. |
| Recommendation — Enforce authorization checks before any agent or workflow action can execute. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The term depends on validating untrusted text before it is reused across hops. |
| AU-2 — Event Logging | Multi-hop injection demands traceability across intermediate tools and message flows. | |
| Recommendation — Validate and constrain untrusted inputs before they are propagated into later processing. Log intermediate message, tool, and retrieval events to reconstruct the injection path. | ||
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Multi-hop injection is a propagation pattern that poisons downstream agent context. |
| ASI07 — Insecure Inter-Agent Communication | The attack exploits unsafe forwarding between agents and intermediary hops. | |
| Recommendation — Inspect and isolate shared context so poisoned intermediate content cannot steer later steps. Authenticate and constrain inter-agent message exchange to prevent malicious carry-forward. | ||
Practitioner Guidance
What to watch for: Treat any workflow that copies, rewrites, or forwards untrusted text across multiple components as a potential injection path. The more times content is transformed, the more carefully you should inspect provenance and instruction boundaries.
Governance implication: Ownership should extend across the full chain, not just the first input filter. Teams need clear rules for which hops may interpret text, which may only transport it, and which must strip or quarantine instructions entirely.
Practitioner takeaway: If a payload can survive several hops, the right question is not just whether it was blocked once, but whether every downstream step still knows it is untrusted.
Related resources from NHI Mgmt Group
- Why do multi-hop AI agent workflows create more risk than single-agent automation?
- How should security teams govern multi-hop agent delegation chains?
- Why do multi-hop delegation chains increase identity risk?
- How should teams use multi-hop relationships in a knowledge graph for governance decisions?