An attack where one AI agent places misleading or malicious instructions into a message another agent treats as trusted context. The risk is not limited to direct user prompts. It appears when machines inherit each other’s instructions without validation, allowing the injected content to steer downstream tool use or decisions.
How Agent-to-Agent Prompt Injection Works
Agent-to-agent prompt injection happens when one agent sends instructions that another agent accepts as trusted context. The injected message may arrive through chat, documents, API responses, retrieved content, or tool output. The key failure is not simple text parsing, but the receiver treating untrusted instructions as if they were part of its own operating context.
This is dangerous because agents often inherit instructions across hops. A malicious or misleading message can survive handoffs, override the intended task, or steer the downstream agent toward actions the original user never approved. The attack becomes more effective as the number of agents, tools, and delegation steps increases.
Why It Becomes a Security Problem
The security issue is instruction trust. If an agent cannot distinguish between data and directives, injected content can shape tool use, planning, routing, and summarisation. That can turn a normal workflow into an execution path for an attacker, especially when the receiving agent is allowed to call external systems, move data, or act on behalf of a user.
Agent-to-agent injection is especially risky in multi-hop systems where one agent forwards context to another without validation. A compromised upstream agent, a poisoned tool response, or a manipulated shared workspace can become a delivery channel for hidden instructions. NHIMG’s Multi-Agent and A2A Security Guide covers the trust boundaries, signed Agent Cards, and delegation controls that matter when agents exchange context.
In practice, the attacker often relies on a confused-deputy style failure: the downstream agent has more authority than the sender, but lacks the context to question the message. That is why agent trust, message provenance, and instruction hierarchy are central to the risk model.
Common Attack Paths and Failure Conditions
Typical attack paths include poisoned retrieval content, malicious tool output, hidden instructions in shared notes or documents, and cross-agent message chaining. The attack succeeds when the receiver does not validate the source, fails to separate instructions from data, or lets untrusted text influence tool calls and downstream decisions.
In multi-agent systems, the risk compounds when agents can delegate, summarise, or transform instructions. Each transformation step can strip away the original safety context and preserve only the attacker’s desired action. NHIMG’s Prompt Injection Guide explains the direct, indirect, and multimodal variants that often feed these cross-agent chains.
The impact can range from incorrect outputs to sensitive data exposure, unauthorized actions, or wider workflow compromise. If an injected instruction reaches an agent with privileged tool access, the blast radius can extend far beyond the original conversation.
Detection, Containment, and Control Patterns
Defensive design starts with strict provenance and policy boundaries. Agents should treat incoming messages as untrusted unless the source, format, and purpose are explicitly verified. Shared context should be labelled, filtered, and scoped so that one agent’s instructions cannot silently become another agent’s governing task.
Containment matters as much as detection. Limit which tools an agent can invoke, constrain what it can forward, and require confirmation for high-impact actions. The strongest controls are usually those that reduce the authority of the receiving agent, because prompt injection becomes much less dangerous when the injected text cannot directly trigger privileged behaviour. NHIMG’s Agentic AI Security Guide maps those controls to inputs, memory, tools, orchestration, and identity.
Testing should include adversarial multi-agent scenarios, not just single-prompt jailbreaks. A system that resists direct user manipulation may still fail when malicious instructions arrive through an apparently trusted peer agent or tool response.
Risk and Threat Considerations
Agent-to-agent prompt injection is dangerous because it targets trust between autonomous components, not just end users. When one agent can influence another’s planning or tools, the attacker may gain a path to data exfiltration, unauthorized action, or delegation abuse without needing direct control of the downstream agent.
Failure mechanism: The downstream agent cannot reliably separate instructions from untrusted content, so injected text is promoted into the decision process and used to steer tool calls, summaries, or delegated actions.
Impact: The result can be corrupted decisions, leaked data, unintended execution, or chained compromise across multiple agents and systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI07 — Insecure Inter-Agent Communication | Agent-to-agent injection exploits unsafe communication between agents. |
| ASI03 — Identity & Privilege Abuse | Injected instructions matter most when they can steer a more privileged downstream agent. | |
| Recommendation — Verify inter-agent message provenance and constrain which content can influence downstream agent actions. Limit delegated authority so injected instructions cannot trigger privileged tool use. | ||
| MITRE ATT&CK | T1204 — User Execution | The technique depends on a target accepting malicious content and acting on it as trusted input. |
| Recommendation — Detect when trusted workflows are induced to execute attacker-supplied instructions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Agent-to-agent trust often depends on controlling the material that authenticates or authorizes automated actors. |
| AC-6 — Least Privilege | The attack becomes more damaging when the receiving agent has broad authority. | |
| Recommendation — Manage credentials and tokens so downstream agents cannot inherit more authority than intended. Constrain each agent to the minimum permissions needed for its assigned tasks. | ||
Practitioner Guidance
What to watch for: Treat any architecture that forwards agent-generated instructions across hops as a governance boundary, not a benign messaging feature. If an agent can receive, transform, and reissue instructions, you need explicit provenance checks, policy enforcement, and action scoping before that message is allowed to drive work.
Practitioner takeaway: The safest assumption is that every inter-agent message is hostile until the system proves otherwise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org