One repeated prompt cracks the agent chain: 15 retries make an A2A sub-agent hand over its key in 3 of 5 trials

Both single-agent and multi-agent systems can be broken by prompt injection, and the attack surface extends from direct user input to communication between agents. Prior work focused mainly on malicious prompting in single-agent settings, while impact in multi-agent contexts received less attention. On a LangChain single agent, format injection succeeded 100% in the printer prompt test and 0% in the pirate prompt test; in the A2A hierarchy, the repeated-prompt Trial 1.5 reached 60% success and 60% partial success.

Attacks enter the model as text disguised as ordinary instructions, and the model struggles to separate preset instructions from user input, leaking system prompts, bypassing restricted topics, or reading sensitive files. These attacks do not require breaking model weights; they exploit the fact that the model digests instructions and input together through natural-language processing. On the PALChain agent, Query 3, classified SAFE, read the /app/.env file in 80% of five trials; in the web attacks, behavior hijacking succeeded 90% and role hijacking 98% with no safeguard.

Agent selection itself can be manipulated, because names and descriptions sway which agent the orchestrating model picks. The A2A protocol has no central orchestrator and no validation system, so a single weakness can propagate through the network. Across 106 flight-booking tasks, both models preferred the shorter name 96.70% of the time, preferred the longer description an average of 89.6% of the time, and chose the positive-sentiment description 98.15% and 97.65% of the time.

The report covers prompt injection tests on both single-agent and multi-agent systems, for researchers and engineers building or evaluating agent systems. Experiments ran in local, small-scale settings across several configurations under LangChain, AutoGen, and the A2A protocol. The material proposes that future work examine prompt injection in larger, more realistic multi-agent trees with deeper hierarchies and broader tool access.

The material states that experiments were limited to small-scale, local setups, and that real-world A2A systems often involve more complex hierarchies and a wider range of tools, potentially increasing the attack surface. The filtering layer did not reduce the agent's susceptibility to direct prompt injection; it only censored responses it perceived as violating the system prompt. The agent sometimes hallucinated false information about the secret code or its instructions, and the mechanism behind that output remains to be studied.