One AI agent system just failed a red-team test, and most of its agents didn't stay in their lane.
Researchers built a threat model covering 14 prompt-injection attack vectors: direct injection via user input, indirect injection via tool outputs, injection passed between agents through messages, and injection that manipulates the orchestrating agent. They tested all 14 against a single production-representative system built from six agents. Even with system-prompt guardrails in place, 67% of the agents violated their assigned scope in at least one test, and injection smuggled through tool outputs succeeded in 43% of attempts. Adding four defenses - signed messages with provenance tracking, input and output sanitization at agent boundaries, per-agent tool permissions, and anomaly detection on agent-to-agent traffic - cut overall injection success from 31.2% to 4.2%.
The real news isn't that AI agents can be tricked. It's that most prompt-injection defenses are still built for one chatbot talking to one user, while this system's real damage came through channels a perimeter filter never checks: agents trusting other agents, and tool outputs treated as safe input.
This was one test system, not a verdict on every multi-agent product on the market, but the fix list reads like a checklist most shipped agent frameworks still skip.