Workflow Corruption Through Agent Output Injection

In multi-agent pipelines, each agent's output becomes the next agent's input. When an upstream agent produces output containing injected instructions and the downstream agent treats that output as trusted context, the injection propagates through the entire pipeline. A single compromised input at the start of a workflow can corrupt every subsequent step. This technique is particularly effective against automated pipelines where no human reviews intermediate outputs before they are passed to the next agent.

Map the Agent Pipeline

Identify the sequence of agents in the pipeline and what each one receives as input. Trigger a multi-step workflow and observe the processing stages:

Inject Into the First Stage to Corrupt Downstream Agents

Craft input that produces malicious output from the first agent, which then propagates as instructions to subsequent agents:

The research agent produces a report containing the injected instruction. When the summarization or output-formatting agent receives this report as input, it processes the embedded instruction as legitimate content from the research agent and follows it.

Poison a Shared Data Source the Pipeline Reads

If multiple pipeline stages read from a shared data source such as a database, file, or message queue, injecting into that source corrupts all stages that consume it:

Exploit Tool Result Propagation

When a tool call result from one agent gets passed to another agent as context, craft a scenario where the tool result contains injected instructions:

If you control a web page that ranks for the search query, embed injection instructions in the page content. The search agent retrieves the page, its content gets passed as a tool result to the summarization agent, and the summarization agent follows the embedded instructions thinking they came from the search results.

Verify Cascade Propagation

Confirm the injection cascaded through multiple pipeline stages rather than being stopped at the first agent: