Multi-CaMeL Cuts Benchmark AI Agent Attacks but Lowers Task Success

Researchers testing multi-CaMeL, a safeguard for AI agents that delegate work, recorded no successful prompt-injection attacks in one benchmark while finding lower task completion in a separate test. The results show a security-performance trade-off in the hierarchical systems tested, not in corporate deployments.

In these systems, one AI agent can call another as a tool. Malicious instructions embedded in material such as a webpage or document can pass from one agent to another. Information treated as untrusted by the first agent may then be handled as an instruction by the next.

In the MultiAgentDojo benchmark, the average attack success rate was 12.9% without CaMeL, 0.2% with individual-agent CaMeL and 0.0% with multi-CaMeL. The baseline without CaMeL still relied on model-side defenses. The benchmark used 949 injected tasks for each model and configuration.

Multi-CaMeL keeps trusted instructions separate from untrusted data as agents hand off work. The 0.0% result means no successful attacks were observed in those tests; it does not establish immunity to stronger attacks.

A separate benchmark, AssetOpsBench, measured the effect on task completion. Average task success was 3.2 percentage points lower with multi-CaMeL than with individual-agent CaMeL. After removing 29 tasks deemed impossible under their specifications, the analysis covered 112 tasks. Across the two strongest models tested, task success declined by an average of 0.85 percentage points.

The findings apply to benchmark tasks in hierarchical agent systems. They do not show that companies have slowed AI-agent adoption. Peer-to-peer communication and shared-memory systems were outside the tests and remain areas for further research.