Agentic AI Security: Prompt Injection, Tool Hijacking, and Voice Agents
Quick Answer
This topic gathers richards.ai's work on what changes when LLMs gain tools, memory, and peer agents: multi-agent prompt injection, tool hijacking, memory poisoning, and voice-agent variants. The cluster treats these as one authority-propagation problem, and offers reading paths for practitioners (checklist), leadership (executive brief), researchers (source papers), and newcomers (explainers and glossary).
Agentic AI Security: Prompt Injection, Tool Hijacking, and Voice Agents
This topic collects everything richards.ai has published on securing agentic AI systems — LLMs with tools, memory, and peer agents. The artifacts cluster around one observation: prompt injection in agentic systems is a confused-deputy and authority-propagation problem, not a string-filtering problem. The new hardening paper is now the canonical defense reference for the cluster and supersedes the earlier exploitation paper, which remains listed for historical context. Some reproduction detail is withheld in the linked artifacts per per-artifact risk controls.
What this topic covers
In scope: multi-agent prompt injection and its named sub-classes — cross-agent infection, memory poisoning, tool hijacking — plus the retrieval and voice-modality variants of the same authority-confusion pattern. The cluster spans threat models, engineered defenses, glossary terms, an operational checklist, and a live tool. Out of scope: single-agent jailbreaking that involves no tools, memory, or inter-agent channels, and vendor-specific deployment guidance for any one orchestration framework.
How to read this page
Newcomers should start with the multi-agent prompt injection explainer, which frames the threat model the rest of the cluster assumes, then branch into the tool-side, retrieval, and voice explainers as needed. Practitioners reviewing or building a system should work directly from the defense checklist, which operationalizes the hardening paper's controls. Engineering leads and security leadership who will not read the full paper get the same conclusions in the executive brief. Researchers should read the two papers in publication order — exploitation first, then hardening — to see how the defensive architecture answers the attack taxonomy.
Where this topic sits
This cluster sits inside the security pillar and is the largest topic on the site to date; sibling clusters live on the topics index. The source research it curates, along with work outside this cluster, is collected on the papers index.
Papers
2 membersHardening Multi-Agent Systems Against Prompt Injection
NoteCanonical defense reference for the cluster; layered architecture and adaptive evaluation. Read this first if you want the controls.
Exploiting Multi Agent Systems: How Prompt Injection Turns Collaboration into Compromise
NoteEarlier attack-side companion, now superseded by the hardening paper; kept for historical context on how the threat model emerged.
Learn
4 membersWhat Is Multi-Agent Prompt Injection? Attack Paths and Defenses
Multi-agent prompt injection is indirect prompt injection whose carrier is another agent. An attacker plants instructions in content that…
NotePlain-language entry point to the threat class; start here before the paper if multi-agent prompt injection is new to you.
What Is Tool Hijacking? When AI Agents Run the Wrong Function
Tool hijacking is the class of attack where an adversary steers an AI agent's function calls: which tool it invokes, with what arguments,…
NoteExplainer on tool-selection and tool-manifest attacks; complements the cross-agent material with the tool-side surface.
What Is RAG Data Exfiltration? Retrieval-Channel Attacks on LLM Apps
RAG data exfiltration is a class of attack where a retrieval-augmented generation system leaks sensitive data because of what it…
NoteRetrieval-channel exfiltration explainer; the memory and retrieval surface that memory-poisoning attacks target.
What Is Voice-Agent Jailbreaking? Why Spoken Prompt Injection Is Different
Voice-agent jailbreaking is prompt injection delivered through a real-time spoken conversation, where an attacker convinces an agent to…
NoteVoice modality variant of the same authority-confusion problem; included to show the pattern beyond text-only stacks.
Glossary
4 membersMulti-Agent Prompt Injection
Multi-agent prompt injection is a class of indirect prompt injection that arises when LLM-driven agents collaborate. An attacker plants…
NoteOne-screen definition of the umbrella term used across this cluster.
Cross-Agent Infection
Cross-agent infection is a multi-agent prompt injection pattern in which an already-compromised agent propagates the adversary's…
NoteDefines the lateral-spread attack class — one compromised agent embedding instructions for peers.
Memory Poisoning
Memory poisoning is a prompt-injection variant in which an attacker causes malicious instructions or false facts to be written into an…
NoteDefines the temporal attack class — injected content stored in shared memory and reactivated later.
Tool Hijacking
Tool hijacking is the class of attack where an adversary causes a tool-using LLM agent to exercise its delegated authority on the…
NoteDefinition for the tool-manifest and tool-selection attack surface referenced throughout the cluster.