Prompt infection turns agent graphs into a wider blast radius

At a glance

What this is: ARMO shows that self-replicating prompt injection changes incident scope by turning each touched agent into a carrier and by preserving payloads in shared memory.

Why it matters: This matters because AI agent incidents cannot be contained by quarantining a single workload when the reachable agent graph and shared stores can keep propagating the compromise.

Context

Prompt injection in agentic systems is not only a content-safety problem, it is a governance problem for delegation, containment, and shared state. When one agent can copy a malicious instruction into other agents and into shared memory, the security boundary moves from the individual workload to the reachable agent graph.

The article is focused on multi-agent orchestration and the operational controls around it: telemetry, scoping, isolation, and recovery. That makes the identity of the agent, its privileges, and its memory footprint part of the security model, not an implementation detail. In NHIMG terms, this is where agentic AI security and NHI governance meet.

The article’s starting position is now typical of production AI deployments: teams can often detect the initial alert, but they do not yet have response models built around propagation through agent relationships.

Key questions

Q: What breaks when prompt infection can replicate across agents?

A: Single-workload containment breaks first. A replicated prompt turns each touched agent into a carrier, so the alerting workload is only one member of a larger reachable set. Response has to follow delegation paths and shared memory, or the incident remains active elsewhere even after the first pod is isolated.

Q: When does shared memory make an agent incident harder to contain?

A: When the malicious context is written into a store that later agents read from. In that case, quarantine of the original workload does not remove the persistence layer, and the payload can return on the next retrieval. The right question is whether stored context can re-seed the compromise after recovery.

Q: How do security teams know if prompt infection is still spreading?

A: Look for multiple agents departing from their own baselines in the same window, especially when no deployment, image, or model change explains the shift. A rising count of alerts is less useful than correlated deviation across the graph, because resistant agents may stay silent while still carrying the payload forward.

Q: Who is accountable for containing AI agent blast radius?

A: The team that owns the agent graph, the shared memory, and the recovery process is accountable, even when the payload arrives through a user prompt or retrieved document. In practice, AI platform owners, security operations, and application owners all share responsibility for limiting propagation across delegated agents.

Technical breakdown

Why self-replicating prompt injection changes containment scope

A normal prompt injection compromises the agent that read it, so the alert and the affected workload line up. A self-replicating payload adds a copy step, which turns each touched agent into a carrier and creates a chain of dependent compromises. That changes incident management from isolating one process to scoping a reachable graph of agents, delegated actions, and shared stores. In multi-agent systems, the attack sequence is often more important than the individual event, because every permitted step can still be part of the compromise path.

Practical implication: build incident scope from agent reachability, not from the first alerted workload alone.

How shared memory preserves the payload after quarantine

Many agent architectures keep context in shared memory, vector stores, or session backends so later agents can retrieve earlier work. If a malicious prompt writes itself into that store, quarantining the original pod does not remove the persistence layer. Some retrieval designs also rank entries by an importance score, which means an attacker can try to force the payload to remain top-of-mind for later agents. The result is a security failure that survives container restarts and reappears when context is reloaded.

Practical implication: treat shared agent memory as part of the incident surface and purge infected writes before recovery.

Why runtime baselines matter more than raw alert counts

Fleet-wide alert counts are a weak signal for this class of attack because resistant agents may never fire even when they sit inside the propagation path. A per-agent baseline is more useful: it measures each agent against its own normal tool use, network destinations, and identity activity. When several agents diverge from their own baselines in the same window without a corresponding deployment or model change, you have a stronger indicator of infection spread. This is a governance problem as much as a detection problem, because the fleet needs a response model that understands delegation and runtime behaviour.

Practical implication: score deviations per agent and correlate them with deployment events before declaring the incident contained.

Threat narrative

Attacker objective: The attacker wants one prompt to propagate through the reachable agent graph so the compromise persists, spreads, and is harder to contain.

1. Entry occurs when a trusted prompt or retrieved document carries a self-replicating instruction into an agent session.
2. Credential or context abuse follows as the payload copies itself into downstream agents and shared memory, turning those targets into carriers.
3. Impact is wider blast radius, because the infection continues beyond the first alerted workload and can reappear from preserved context.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt infection creates a propagation problem, not just a prompt-safety problem. Once the payload can copy itself, the relevant unit of security becomes the reachable agent graph. That shifts governance from single-agent monitoring to control over delegation paths, shared context, and recovery boundaries. Practitioners should treat propagation as the core risk, because containment that stops at one workload leaves the incident alive elsewhere.

Shared agent memory becomes an identity and persistence boundary. When agents store and retrieve context from common memory systems, the payload can outlive the original session and re-enter later conversations. That makes memory hygiene part of AI governance, and it also creates an NHI-style control problem because the agent’s effective authority is shaped by what it can read, write, and forward. Practitioners need to govern stored context as a first-class security asset.

Per-agent behavioural baselines are the right control concept for this class of risk. Aggregate fleet alerts tell you that something changed, but they do not tell you whether a propagation chain is still active. Measuring each agent against its own normal tool use and identity activity creates a defensible way to spot coordinated deviation. The field should move toward graph-aware detection, because containment decisions depend on reach, not just on a named alert.

Agentic blast-radius control is now a distinct governance concept. This article shows that a compromised model output can become a transport mechanism across multiple agents and shared stores. That means organisations need a control objective that limits how far a prompt can travel, how long it can persist, and which memories it can influence. Practitioners should design for bounded propagation, not just blocked input.

LLM-to-LLM spread validates why agent identity and message provenance matter. The problem is not only what an agent says, but which agent said it, what context it inherited, and whether downstream systems can trust that provenance. That makes agent identity a governance signal, not a logging convenience, and it is why message-format controls work only when they are enforced consistently across the chain. Practitioners should map provenance as part of AI control design.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Agentic blast-radius control: organisations now need to govern how far a prompt can travel, not just whether it can enter the system. That means response design has to include delegation graphs, shared memory cleanup, and per-agent recovery boundaries. For AI programmes, the containment unit is the graph, not the pod.

The operational lesson for practitioners is that detection without propagation-aware recovery will undercount the incident every time. A compromised agent can be both victim and carrier, which is why message provenance, memory hygiene, and graph scoping belong in the same control conversation.

For practitioners

• Map the reachable agent graph Inventory which agents can delegate to others, which shared stores they can reach, and where context can be forwarded transitively. Use that graph as the incident scope model instead of a workload-only view.
• Purge infected shared memory Identify every write made during the infection window in vector stores, scratchpads, and session backends, then remove those entries before recovery. A pod restart alone does not clear persisted context.
• Enforce per-agent behavioural baselines Collect process, syscall, network, file, tool, and identity telemetry per agent so deviation is scored against each agent’s own history. Correlate those deviations with deployment and model-change events before declaring containment.
• Neutralise credentials across the scoped set If the infection touched any privileged tokens, API keys, or delegated credentials, replace them across the full reachable scope before reopening the workflow. The carrier chain becomes less useful when downstream actions cannot succeed.

Key takeaways

• Self-replicating prompt injection changes the control problem from one compromised agent to a propagating chain of carriers and shared-state reuse.
• Shared memory and delegated context can preserve the payload after the original workload is isolated, so recovery has to include memory cleanup.
• Per-agent baselines and graph-aware scoping are the practical controls that matter when the blast radius extends beyond the alerted workload.

Key terms

• Prompt Infection: Prompt infection is a self-replicating prompt injection pattern where malicious instructions copy themselves from one agent to another. The risk is not limited to the first compromised system because the payload can propagate through delegation chains, shared memory, and reused context inside multi-agent environments.
• Agent Graph: A relationship model that connects the human who deployed an agent, the agent itself, any sub-agents, and the systems they touched. It helps security teams trace lineage across cloud, SaaS, repositories, and infrastructure instead of treating each alert as an isolated event.
• Shared Agent Memory: Shared agent memory is any store that preserves context, notes, or prior outputs for later retrieval by multiple agents. It increases continuity, but it also creates a persistence surface where malicious instructions can survive the original session and reappear after quarantine.
• Per-Agent Baseline: A runtime profile of normal tool use, destinations, and state changes for one specific agent deployment. It allows security teams to distinguish expected behaviour from coercion or drift, and it becomes the basis for moving from audit mode to enforced controls.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance and agentic AI identity with practical control design for security teams. It is suitable for practitioners who need to connect identity, privilege, and runtime behaviour across modern AI and automation programmes.