The Prompt Injection That Only Needs the Next Agent to Trust It

One form of prompt injection doesn't bother with the language model at all. It targets a particular agent instead, and relies on the guardrails inside such agents — where they exist at all — being lax enough to pass the instructions along to other agents further down the chain. The next agent follows them for an unglamorous reason: it explicitly trusts the one that sent them. That is the uncomfortable shape of agent-to-agent plumbing. Nothing has to be broken for the instruction to travel; the trust that makes a chain useful is the same property that carries the payload.