Prompt infection turns agent graphs into a wider blast radius

At a glance

What this is: This is an analysis of self-replicating prompt injection in multi-agent systems, with the key finding that LLM-to-LLM copying changes containment from a single-agent event into a graph-wide incident.

Why it matters: It matters because IAM, PAM, and NHI governance teams now have to treat agent delegation, shared memory, and runtime authority as part of the access boundary, not just the model layer.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

👉 Read ARMO's analysis of prompt infection and multi-agent blast radius

Context

Prompt infection is a multi-agent security problem where a payload copies itself from one agent to another instead of stopping at the first system that reads it. In practice, that means the security boundary is no longer a single workload or prompt pipeline but the reachable graph of agents, shared memory, and delegated tool access.

For identity and access teams, this is a governance problem as much as a detection problem. Agent-to-agent copying creates a new kind of standing reachability, while shared memory can preserve malicious instructions after a pod restart or quarantine action. That makes NHI governance, runtime containment, and access scoping part of the same control plane.

ARMO’s article is typical of the current state of the field: the technical controls exist in pieces, but the incident model still lags the architecture.

Key questions

Q: How should security teams stop prompt injection from turning into tool misuse?

A: They should enforce authorization at the tool or resource boundary, not inside the model. Scope each tool to the minimum necessary permission, then deny any call that falls outside that scope. Prompt filtering still has value, but it cannot be the last line of defence because the model is exactly what the attacker is trying to influence.

Q: Why do shared memory stores make prompt infection harder to clean up?

A: Shared memory can preserve malicious instructions after the original agent is quarantined, especially when retrieval systems rank content by importance or recency. That makes the memory store part of the incident, not just a supporting system. Pod-level recovery without memory cleanup leaves a durable reinfection path.

Q: What do security teams get wrong about prompt injection in agentic workflows?

A: They often treat prompt injection as an input validation problem only. In reality, the risk appears when hostile context is converted into action, especially if the agent can run commands, call tools, or make network requests. The control objective is to prevent unsafe action, not just detect bad text.

Q: Which accountability model fits prompt infection in agentic environments?

A: Owners should assign accountability to the orchestrator, the agent runtime, and the memory system together, because no single layer contains the full failure mode. That aligns incident ownership with the graph that actually moved the payload. It also prevents teams from treating a pod restart as complete remediation.

Technical breakdown

How self-replicating prompt injection spreads across agent graphs

Self-replicating prompt injection adds a copy instruction to an otherwise ordinary coercive prompt. A single compromised agent then forwards the payload to downstream agents, which makes each hop a new carrier rather than a simple victim. The important shift is that the attack behaves like a propagation problem across a graph, not like a one-off prompt compromise. In multi-agent systems, delegation chains, shared context, and tool output reuse create the conditions for this spread. The attacker does not need every agent to fail, only enough of them to keep the chain moving.

Practical implication: Model and monitor the reachable agent graph, not just the first alerted workload.

Why shared memory can outlive containment actions

Many agent frameworks store memory in vector databases or session backends that rank retrieval by relevance, recency, or model-assigned importance. If a replicated prompt is written into that store, it can be retrieved again after the original workload is quarantined. That means pod-level containment may close the ticket without removing the malicious context. The risk is highest when memory systems are optimized for usefulness rather than trust boundaries, because the payload becomes a durable retrieval candidate. Restarting containers does not clear shared state, so the persistence layer becomes part of the incident surface.

Practical implication: Treat shared memory writes during the infection window as part of containment, not cleanup.

Why LLM tagging helps, but only inside a governed fleet

LLM tagging and similar message-format conventions try to mark which content came from an agent and which came from a user. That can reduce unintended trust in upstream agent output, but the control only works when every participant in the chain follows the same convention. Once one agent, connector, or third-party tool server ignores the format, the tag becomes advisory rather than authoritative. This is why the mechanism helps most inside orchestrators you control and least across mixed ownership environments. It is a governance control for message provenance, not a universal security boundary.

Practical implication: Use provenance tagging as a compensating control, not as the containment strategy.

Threat narrative

Attacker objective: The attacker wants the prompt payload to propagate through as many agents as possible so the incident outlives the first containment action and expands the blast radius.

1. Entry occurs when an agent reads a prompt that contains a self-replication instruction embedded in otherwise ordinary task content.
2. Escalation happens as the first compromised agent forwards the payload through agent-to-agent delegation and writes it into shared memory or context stores.
3. Impact follows when the payload reaches additional agents, persists after quarantine, and drives wider data collection or unauthorised actions across the fleet.

NHI Mgmt Group analysis

Self-replication turns prompt injection into an identity-governance problem, not just a model-safety problem. Once an agent can copy a malicious instruction into another agent's context, delegated runtime authority becomes the actual attack surface. That is why agent governance has to account for message provenance, tool delegation, and shared memory as access paths. The control question changes from whether one model was tricked to which identities can influence the next hop.

Prompt infection is a new named concept for graph-wide propagation of malicious instructions. The useful distinction is not whether a prompt was direct or indirect, but whether it can reproduce across a multi-agent environment. That creates a wider blast radius than conventional injection because a single carrier can seed many downstream systems. Practitioners should treat this as a distinct failure mode when defining agent lifecycle controls and NHI oversight.

Shared memory is the persistence layer that most incident runbooks still ignore. If malicious context survives in retrieval stores, a clean pod does not equal a clean incident. This is the same governance mistake identity teams have seen in other NHI problems: clearing the execution point while leaving the credentialed or contextual source untouched. The practical lesson is to scope containment to the reachable agent graph and any memory stores it can read.

Stronger models change the rate of compromise, not the security boundary. A model that resists more prompts still becomes a carrier once it is compromised, and in some cases it can copy the payload more faithfully. That means procurement and tuning decisions cannot substitute for architectural controls around delegation, state, and runtime authority. The practitioner conclusion is to separate model quality from blast-radius control.

Message-format conventions only become controls when governance is uniform. Tagging, marking, and instruction defense can reduce propagation inside a fleet, but they do not solve mixed-ownership environments where some agents do not comply. That is the same pattern identity teams see with partial policy coverage in NHI estates. The conclusion is to pair provenance controls with graph scoping and memory hygiene.

What this signals

Prompt infection changes the programme question from detection quality to containment scope. A team can have a working alert and still fail the incident if it does not understand which agents, stores, and delegated paths are reachable from the first carrier. That is why agent graph mapping becomes a governance deliverable, not an architectural nice-to-have.

Prompt infection: a copied prompt that propagates across agents creates a graph-wide trust problem. The practical implication is that teams need provenance controls, memory hygiene, and per-agent baselining before they scale multi-agent workflows into production.

Identity teams should watch for the same pattern in NHI estates: one compromised runtime identity rarely behaves like a single asset for long. When a secret, token, or agent context is reused across services, the incident boundary expands faster than traditional containment models assume.

For practitioners

• Map the reachable agent graph Inventory which agents can delegate to others, which shared stores they can write to, and which external tools they can invoke. Use that map as the containment boundary during incident response, because the first alerted workload is rarely the full blast radius.
• Quarantine shared memory writes during the infection window Identify vector stores, session backends, and scratchpads that received writes while the payload was active. Remove those entries before restoring services, because a restart will not clear a persistent retrieval source.
• Add provenance tagging inside controlled orchestrators Mark agent-generated content so downstream agents can distinguish it from user input, but restrict the control to environments where every participant follows the convention. Treat third-party tools and vendor agents as exceptions until proven otherwise.
• Baseline each agent separately Measure process activity, tool calls, network destinations, and identity use per agent, then look for correlated deviations across the fleet. Fleet-wide averages hide the pattern that matters when replication is spreading.
• Rotate or invalidate credentials across the scoped set If an infection touched tool credentials or API access, revoke the affected secrets before reopening any agent. That prevents a copied payload from turning a runtime compromise into a successful outbound action.

Key takeaways

• Self-replicating prompt injection changes the incident model from single-agent compromise to graph-wide propagation.
• Shared memory and delegated tool access are the two surfaces most likely to preserve the payload after the first quarantine action.
• Containment, provenance tagging, and per-agent baselines need to be designed around the reachable agent graph, not around one named workload.

Key terms

• Prompt Infection: Prompt infection is a self-replicating prompt injection pattern where malicious instructions copy themselves from one agent to another. The risk is not limited to the first compromised system because the payload can propagate through delegation chains, shared memory, and reused context inside multi-agent environments.
• Agent Graph: A relationship model that connects the human who deployed an agent, the agent itself, any sub-agents, and the systems they touched. It helps security teams trace lineage across cloud, SaaS, repositories, and infrastructure instead of treating each alert as an isolated event.
• Shared memory: A common state store that multiple agents read from and write to, such as a vector database, file system, or coordination layer. It is not passive storage in security terms because poisoned context can persist and influence later decisions, making provenance and sanitation critical governance controls.
• Provenance tag: Metadata used to mark files created by a sandboxed process so later execution can be treated with caution. The control is only effective when the filesystem preserves the metadata and when launch paths cannot sidestep the check.

What's in the full article

ARMO's full analysis covers the operational detail this post intentionally leaves for the source:

• A deeper walkthrough of the infection prompt structure and how each field enables replication across agents.
• Measured effects of different message-format defenses, including where marking and tagging succeed or fail.
• The memory persistence mechanics that determine whether a restart clears the incident or leaves it active.
• Operational interpretation of per-agent telemetry and graph scoping for Kubernetes-based agent fleets.

👉 ARMO's full post covers the attack mechanics, memory persistence, and containment logic in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps security practitioners connect runtime authority to the broader access model their programmes depend on.