aiqbench analysis
This research identifies critical security vulnerabilities in LLM-driven robotic systems, demonstrating how prompt injection attacks can propagate across multi-agent networks to cause unsafe physical actions. By analyzing both direct instruction injections and indirect perception-based vectors, the study highlights that shared prompt architectures significantly amplify attack surfaces compared to single-agent setups. These findings are essential for developing robust safety protocols as autonomous agents become more integrated into real-world environments where failure could result in tangible harm.
When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems
arXiv:2608.00747v1 Announce Type: new Abstract: Large language models are increasingly integrated into autonomous robotic systems for task planning and control, but this integration exposes them to prompt injection attacks that can lead to unsafe decisions and physical harm. Multi-agent settings increase the risks through cross-agent contamination and broader attack surfaces. In this paper, we evaluate prompt injection attacks against an LLM-based multi-agent robotic system, considering both direct injections into task instructions and indirect injections through perception modules. In our experiments across varying attack-goal complexities and injection strategies in both single-agent and multi-agent settings, we show that prompt injection can induce adversarial actions while reducing task completion. We find that attacks can propagate from one agent to others through shared prompt structures, with impacts varying depending on prompt composition and the targeted agent. We further analyze how architectural changes affect LLM queries and, consequently, the attack success. To the best of our knowledge, this is the first study that systematically investigates prompt injection attacks in a multi-agent LLM-based robotic system.
Abstract:Large language models are increasingly integrated into autonomous robotic systems for task planning and control, but this integration exposes them to prompt injection attacks that can lead to unsafe decisions and physical harm. Multi-agent settings increase the risks through cross-agent contamination and broader attack surfaces. In this paper, we evaluate prompt injection attacks against an LLM-based multi-agent robotic system, considering both direct injections into task instructions and indirect injections through perception modules. In our experiments across varying attack-goal complexities and injection strategies in both single-agent and multi-agent settings, we show that prompt injection can induce adversarial actions while reducing task completion. We find that attacks can propagate from one agent to others through shared prompt structures, with impacts varying depending on prompt composition and the targeted agent. We further analyze how architectural changes affect LLM queries and, consequently, the attack success. To the best of our knowledge, this is the first study that systematically investigates prompt injection attacks in a multi-agent LLM-based robotic system.
Robotics (cs.RO); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Multiagent Systems (cs.MA)
arXiv:2608.00747 [cs.RO]
(or arXiv:2608.00747v1 [cs.RO] for this version)
https://doi.org/10.48550/arXiv.2608.00747 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 267 words
Related coverage
Links #5: 2026/07
LessWrong · Jul 31, 2026
Presentation: Automating the Web With MCP: Infra That Doesn’t Break
InfoQ · Jun 16, 2026
Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation
arXiv · Aug 18, 2026
Links #3: 2026/06 Part 1
LessWrong · Jun 15, 2026