In their preprint “Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks,” James Peters-Gill and colleagues reported 0% attack success for Multi-CaMeL on MultiAgentDojo and lower task success in another benchmark.
The safeguard addresses a risk that arises when one agent passes work to another. A website or document encountered during a task can contain instructions planted by an attacker. If that content reaches the next agent without its untrusted status intact, the agent may treat it as an instruction to follow. Multi-CaMeL aims to preserve the boundary between authorized directions and outside material throughout the handoff.
In the MultiAgentDojo benchmark, the researchers measured average attack success at 0% with Multi-CaMeL. The rate was 12.9% without CaMeL and 0.2% when CaMeL protected each agent separately. The researchers ran 949 injected task instances for every model and setup.
The comparison without CaMeL still had defenses built into the models. The 0% finding describes attacks observed in this test; it does not establish how Multi-CaMeL would perform against stronger attacks. The study builds on CaMeL’s earlier use with individual agents and extends the AgentDojo testing framework to delegated work.
A different benchmark, AssetOpsBench, measured whether agents finished their assigned tasks. Average task success with Multi-CaMeL was 3.2 percentage points below the result with individual-agent CaMeL. Researchers excluded 29 tasks they identified as impossible under their specifications, leaving 112 tasks in the analysis.
For the two strongest models, the average difference was 0.85 percentage points. The statistical confidence intervals around task-success results for the two CaMeL setups overlapped for every model, according to the preprint.
Both benchmarks examined hierarchical systems in which an agent can call another agent as a tool. They did not test agents communicating as peers or working from shared memory, which the researchers identified as areas for further study.
