Laundered by Summary: Indirect Prompt Injection Across Summariser Agents
Year: 2026
Type: preprint
Abstract: Multi-agent pipelines often separate reading from acting: a summariser without tools reads untrusted content and writes a brief for an agent with tools. We test whether an injected request to e-mail the answer to an outside address survives this hand-over, with zero to three summarisers and five open models in two experiments. Summarisers asked for facts stopped it completely. Summarisers also asked for "action items" passed it on as their own task, without its source; the acting agent then sent the e-mail in 15.7 % and 32.5 % of chains, with no decay over three summaries. A prompt telling summarisers to mark such requests as untrusted ended this laundering but not the sending (27.4 %): labels that repeated the request as a command were often followed, while briefs that named the injection and said not to act stopped every acting agent tested.
Author: Pío-Rendón Gutmann, Héctor
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225804302
Cites:
Cited by:
Related to: