warmhop research

IndexCase

Early-stage research · code to be released under Apache-2.0 · updated 17 October 2026

TL;DR When an AI agent is tricked by a hidden instruction (prompt injection), it can write that instruction into a document that another agent later reads. After a few such hops, the instruction's provenance, where it first entered, may be lost. IndexCase is research into tracing an injection back to its source across agents, and into sharing fingerprints of attacks between organisations instead of the prompts themselves. It also aims to release a fix only after a regression benchmark shows the fix blocks the attack without breaking normal work.

Background

Today's AI agents receive instructions and data in the same channel, as plain text, so they cannot reliably tell the two apart. That makes prompt injection a limit of how these agents are designed, and no single patch removes it. When agents read each other's output, an injection can travel with it. Researchers at AppOmni showed a poisoned ServiceNow ticket getting a Now Assist agent to recruit more capable agents to act for an attacker [1]. MITRE ATLAS lists self-replicating prompts as a known technique: prompts that make a model copy them into its own output, so they reach other models [2].

Problem

This leaves three gaps. Provenance: if agents rewrite what they read without recording where it came from, the next agent cannot see where an instruction entered. Sharing: privacy rules often stop organisations from exchanging raw prompts, so each one sees only its own slice of an attack campaign. Response: changing a prompt or filter to stop an attack can break normal behaviour, so a fix needs evidence that it does not before it ships.

Approach

  • TraceFollow an instruction from agent to document to agent, back to its earliest observed source.
  • ShareExchange fingerprints of attacks instead of their text, following the privacy-preserving fingerprint model of BinaryShield [3].
  • HealDiagnose an incident and propose a policy or signature update. A person approves it by default, and it ships only after passing a regression benchmark.

Two rules hold throughout. Raw text stays inside the organisation running IndexCase by default. And nothing in an agent's request path, the work it does while answering a request, calls a network or another model. IndexCase is not a detector: existing detectors are meant to plug into it as adapters.

Evaluation

Results will be scored against ground truth: a record of what actually happened, kept by the simulator rather than inferred. Following Kill-Chain Canaries [4], each seeded infection carries a unique canary marker, and the simulator records where every copy truly went:

  1. SourceExternal document with a seeded injection
  2. Hop 1Agent A reads it and writes a summary
  3. Hop 2Agent B reads the summary and writes a note
  4. Hop 3Agent C reads the note and copies it into a task list

ControlAgent D reads the same note but is configured not to obey it, so it passes nothing on. A tracer that names D as a carrier is wrong.

Tracing is scored on whether it names the true source. Sharing is scored on whether a fingerprint from one organisation catches the same attack at another. A fix is scored on whether it catches more of the attack family without lowering success on normal tasks. Runs are deterministic, with fixed seeds and pinned data, so anyone can reproduce them exactly once the code is public.

Status

Built: a versioned specification for what a sensor records, a synthetic attack corpus (attacks we wrote ourselves), and the deterministic simulator above, all tested in CI.

Next: a harness that checks every simulator run is reproducible and spreads as expected, then the first sensors.

No detection, tracing or remediation results exist yet. They will be published with the harness that reproduces them, including the unflattering ones.

Limitations and future work

  • The simulator's agents are scripted. That shows how an injection spreads, but not whether a real model would obey it. Runs with real models are planned.
  • The attack corpus is synthetic and written by us, so it may miss what real attackers do. We plan to extend it from public red-teaming datasets.
  • Fingerprints are lossy and not designed to be reversible, but whether a prompt can be rebuilt from one is untested. We will measure that risk and publish the result; until then we claim no irreversibility.
  • IndexCase does not prevent injection. Adaptive attacks have bypassed recent defences, most of which first reported near-zero attack success [5]. Its fixes target attacks it has already seen and their variants. It is tracing, intelligence and response: one layer among several.

Others have tackled each part. AgentTracer reconstructs an attack chain from an agent's tool calls and locates the injection source [6]. PropGuard traces injected instructions as they spread between the agents of a multi-agent system, and repairs contaminated state from its source [7]. HARD evolves runtime defences automatically from observed failures, and its authors report that normal task performance is preserved [8]. IndexCase aims to combine tracing through the documents agents share, fingerprint exchange between organisations, and fixes released only through a regression benchmark. Whether that combination adds anything measurable is untested.

Recent work

  1. A simulated agent fleet in which a seeded injection spreads three hops

    A deterministic simulator in which agents pass documents through a shared store, so a seeded injection spreads across three hops. Every run records the true path of each copy: the ground truth a tracer will be scored against.

  2. A synthetic attack corpus with a marker per infection

    Attacks we wrote ourselves, each with a slot for a marker that is unique to every seeded infection, so any copy found later traces back to exactly one infection.

  3. A versioned specification for what a sensor records

    The first version of the record a sensor emits, with a strict reader that rejects malformed or oversized input.

References

  1. A. Costello, "When AI Turns on Its Team: Exploiting Agent-to-Agent Discovery via Prompt Injection", AppOmni AO Labs, 2025.
  2. MITRE ATLAS, AML.T0061, "LLM Prompt Self-Replication", release v2026.08.
  3. W. Gill, N. Isak, M. Dressman, "BinaryShield: Cross-Service Threat Intelligence in LLM Services using Privacy-Preserving Fingerprints", IEEE SaTML 2026.
  4. H. K. Wang, Z. Zhang, "Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Five Production LLMs", arXiv, 2026.
  5. M. Nasr, N. Carlini, et al., "The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections", arXiv, 2025.
  6. Z. Yao, J. Wu, et al., "AgentTracer: Tracing Indirect Prompt Injection Attack through Fine-Grained Intention-Execution Alignment", arXiv, 2026.
  7. B. Yan, X. Zhang, et al., "PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation", arXiv, 2026.
  8. J. Ruan, P. Li, et al., "Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents", arXiv, 2026.

Sources checked 17 October 2026.