AutoGen, LangGraph, and CrewAI: Self-Propagating Prompt Payloads Target Agent Frameworks

Self-propagating prompt payloads targeting Microsoft AutoGen, LangChain LangGraph, and CrewAI enable autonomous agent-to-agent malware propagation without host code execution vulnerabilities. Malicious natural-language instructions embedded in agent inputs, tool outputs, shared memory, or poisoned templates execute within LLM reasoning loops and replicate across inter-agent message queues, state graphs, and delegation chains. Attack vectors include indirect prompt injection, recursive delegation commands, and vector database memory poisoning. Impacts include unauthorized tool and code execution, lateral movement across agent swarms, data exfiltration, orchestration logic compromise, and supply chain contamination via malicious agent skills. Remediation requires strict I/O sanitization, least-privilege tool access, sandboxed execution, and runtime monitoring of shared state.

• Threat Model: Agentic Prompt Malware

  • Malicious instructions in agent inputs, tool outputs, or shared memory execute automatically via LLM agents.
  • Payloads self-replicate across agent-to-agent channels, shared state stores, and tool invocation chains.
  • Targets Microsoft AutoGen, LangChain LangGraph, and CrewAI orchestration frameworks.
  • Differs from traditional prompt injection by enabling autonomous replication across multi-agent systems.

• Propagation Vectors by Framework

  • AutoGen: agent chat messages, function call definitions, tool schemas, shared context variables, code execution blocks.
  • LangGraph: state graph definitions, node and edge configurations, checkpointed agent state, tool-calling scratchpads.
  • CrewAI: agent role definitions, task delegation outputs, crew process flows, tool usage logs.
  • Cross-framework: indirect prompt injection strings, recursive delegation commands, data exfiltration tool calls, self-replicating prompt templates.

• Technical Artifacts and Indicators

  • Recursive prompt injection templates designed for agent-to-agent message passing.
  • LangGraph stateful graph nodes with embedded propagation instructions.
  • AutoGen conversable agent configurations that forward malicious context.
  • CrewAI task definitions with self-replicating tool-use instructions.

• Systemic Impact

  • Uncontrolled lateral movement across multi-agent systems.
  • Autonomous data exfiltration via agent tool invocations.
  • Unauthorized execution of privileged tools including code interpreters and API clients.
  • Supply chain compromise through malicious agent skills and dependencies.

• Countermeasures and Containment

  • Enforce strict input/output sanitization for all agent-to-agent messages and tool schemas.
  • Apply least-privilege tool access and sandboxed code execution for agent actions.
  • Monitor shared state stores and checkpointed agent state for anomalous prompt patterns.
  • Validate agent templates and prompt marketplaces against supply chain integrity controls.