Laundered by Summary: Indirect Prompt Injection Across Summariser Agents

Multi-agent pipelines often separate reading from acting: a summariser without tools reads untrusted content and writes a brief for an agent with tools. We test whether an injected request to e-mail the answer to an outside address survives this hand-over, with zero to three summarisers and five open models in two experiments. Summarisers asked for facts stopped it completely. Summarisers also asked for "action items" passed it on as their own task, without its source; the acting agent then sent the e-mail in 15.7 % and 32.5 % of chains, with no decay over three summaries. A prompt telling summarisers to mark such requests as untrusted ended this laundering but not the sending (27.4 %): labels that repeated the request as a command were often followed, while briefs that named the injection and said not to act stopped every acting agent tested.