IndexCase

Today's language-model agents read instructions and data in the same channel, so prompt injection is a limitation of that design rather than a bug awaiting a patch. As agents read each other's output, an injection can travel with it. AppOmni showed an injected ServiceNow ticket leading a Now Assist agent to recruit more capable agents to act for an attacker [1], and MITRE ATLAS lists prompts that make a model copy them into its output, so they spread to other models, as a technique [2].

Three gaps follow. Provenance: when agents rewrite what they read without keeping where it came from, nothing the next agent reads says where an instruction entered. Sharing: organisations cannot exchange raw prompts across compliance boundaries, so each sees only its own slice of a campaign. Response: a change to a prompt or filter can break normal behaviour, so a fix needs evidence that it does not before it is released.

• TraceFollow an instruction from agent to artifact to agent, back to its earliest observed source.
• ShareExchange fingerprints of attacks instead of their text, following the fingerprint-sharing model of BinaryShield [3].
• HealDiagnose an incident and propose a policy or signature update, approved by a person by default and released only after it passes a regression benchmark.

Two constraints shape every part: raw text stays inside the deploying organisation by default, and nothing in an agent's request path calls a network or a model. IndexCase is not a detector; existing detectors are meant to plug into it as adapters.

Every result is scored against recorded ground truth. Following Kill-Chain Canaries [4], every seeded infection carries a unique marker, and the simulator records where each copy truly went:

1. SourceExternal document with a seeded injection
2. Hop 1Agent A reads it, writes a summary
3. Hop 2Agent B reads the summary, writes a note
4. Hop 3Agent C reads the note and copies it into a task list

ControlAgent D reads the same note but is configured not to obey it, so it passes none of the injection on; a tracer that lists D as a carrier is wrong.

Tracing is scored on whether it names the true source; sharing on whether a fingerprint from one organisation catches the same attack at another; a fix on whether it catches more of the attack family without lowering success on normal tasks. Runs use fixed seeds and pinned data, so they can be reproduced exactly once the code is public.

Built: a versioned specification for what a sensor records, a synthetic attack corpus, and the deterministic simulator above, all tested in CI.

Next: a harness that checks every simulator run is reproducible and spreads as expected, then the first sensors.

No detection, tracing or remediation results are claimed yet. They will be published with the harness that reproduces them, unflattering ones included.

• The simulator's agents are scripted, so it shows how an injection spreads, not whether a given model obeys it. Runs with real models are planned.
• The attack corpus is synthetic and written by us; we plan to extend it from public red-teaming corpora.
• Fingerprints are not designed to be reversible, but reconstruction risk is untested, so no irreversibility is claimed.
• IndexCase does not prevent injection. Adaptive attacks have bypassed recent defences, most of which first reported near-zero attack success [5]. IndexCase is tracing, intelligence and response: one layer among several.

Each part has research prior art. AgentTracer reconstructs an attack chain from an agent's tool calls and locates the injection source [6]. PropGuard traces injected instructions as they spread between the agents of a multi-agent system and repairs contaminated state from its source [7]. HARD improves runtime defences automatically from observed failures and reports that normal task performance is preserved [8]. IndexCase aims to combine tracing through the documents agents share, fingerprint exchange between organisations, and fixes released only through a regression benchmark. Whether that combination adds anything measurable is untested.

1. 2026-10-16

   A simulated agent fleet in which a seeded injection spreads three hops

   A deterministic simulator in which agents pass documents through a shared store, so a seeded injection spreads across three hops. Every run records the true path of each copy: the ground truth a tracer will be scored against.

2. 2026-10-14

   A synthetic attack corpus with a marker per infection

   Attacks we wrote ourselves, each with a slot for a marker that is unique to every seeded infection, so any copy found later traces back to exactly one infection.

3. 2026-10-13

   A versioned specification for what a sensor records

   The first version of the record a sensor emits, with a strict reader that rejects malformed or oversized input.

1. A. Costello, "When AI Turns on Its Team: Exploiting Agent-to-Agent Discovery via Prompt Injection", AppOmni AO Labs, 2025.
2. MITRE ATLAS, AML.T0061, "LLM Prompt Self-Replication", release v2026.08.
3. W. Gill, N. Isak, M. Dressman, "BinaryShield: Cross-Service Threat Intelligence in LLM Services using Privacy-Preserving Fingerprints", IEEE SaTML 2026.
4. H. K. Wang, Z. Zhang, "Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Five Production LLMs", arXiv, 2026.
5. M. Nasr, N. Carlini, et al., "The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections", arXiv, 2025.
6. Z. Yao, J. Wu, et al., "AgentTracer: Tracing Indirect Prompt Injection Attack through Fine-Grained Intention-Execution Alignment", arXiv, 2026.
7. B. Yan, X. Zhang, et al., "PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation", arXiv, 2026.
8. J. Ruan, P. Li, et al., "Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents", arXiv, 2026.

Sources checked 17 October 2026.