# New research catalogues prompt-injection routes through agent systems as Nadella says models should be treated as compromised

An arXiv study tests injection through both user input and indirect channels in single-agent and multi-agent setups, and Microsoft's chief executive calls for operators to be able to stop a model mid-task.

- Published: 2026-10-12T06:16:38.065Z
- Canonical: https://polylog.news/ai/2026-10-12/new-research-catalogues-prompt-injection-routes-through-agen
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [arXiv cs.CR](https://arxiv.org/abs/2610.12524), [arXiv cs.CR (Security Brain)](https://arxiv.org/abs/2610.12540), [Polylog editors](https://polylog.news), [Shortform (All-In podcast summary)](https://www.shortform.com/podcast/episode/all-in-with-chamath-jason-sacks-friedberg-2026-09-15-episode-summary-satya-nadella-on-the-ai-doomer-slowdown-microsoft-s-master-plan-who-wins-ai)

A paper posted to arXiv today, "An Exploration of Attacks on AI Agent Systems", studies how prompt injection exploits both direct user input and indirect channels in single-agent and multi-agent systems. The abstract argues that agents need…

This story is for subscribers. Read it in full at https://polylog.news/ai/2026-10-12/new-research-catalogues-prompt-injection-routes-through-agen (subscription information: https://polylog.news/pricing).