Inter-Agent Sanitization Lab: Secure the Agent Message Bus

It is indirect prompt injection that travels through a multi-agent system. Greshake and colleagues argue that LLM-integrated applications blur the line between data and instructions, and describe injecting prompts into data likely to be retrieved. If a reader agent processes such data and passes a message on, the influence can reach the agent that has the tools. This lab is about stopping that on the bus between them.

The lab teaches normalising hidden constructs (markdown or HTML comments), removing or flagging invisible characters, escaping tool-call syntax so it is carried as data and never parsed, and rejecting messages that fail a strict schema. It also teaches that these are hygiene and signals: OWASP says it is unclear whether fool-proof prevention of prompt injection exists, so the bus cannot be the only control.

Instructions can be ordinary visible sentences in a document, or re-encoded, and OWASP lists obfuscated payloads among the ways attackers evade filters. The lab pairs sanitization with capability separation so the agent that reads cannot act, structured messages, least privilege for each agent, and human approval for high-impact calls. These limit what a missed attack can do.

It means the component that sees untrusted content has no dangerous tools, and the component with tools does not see raw untrusted content. This follows OWASP LLM06, which recommends minimising extensions, their functionality and their permissions. In the lab the reader gets read-only access and the actor keeps writes and refunds behind scoped permissions.

The A2A enterprise documentation we read covers transport security, authentication, authorization and least privilege. It says servers must authenticate every request, that payloads carry no identity, and that agents touching backends must enforce authorization before sensitive actions. It does not describe content sanitization, so we do not cite it for that. Treat message content as your job.

Treat them as untrusted input. Invariant Labs, a vendor that sells agent guardrails, reports that tool descriptions can contain instructions the user does not see, and recommends clear display of what the model reads, pinning versions or hashes of tool descriptions, and stronger boundaries between servers. The lab applies the same idea to third-party agents registering on a bus.

Each of the 12 decisions scores 0 to 10 and the result is your share of the maximum, with a short band that says what the score means. The debrief shows the source behind each rationale. Lines labelled PlayCISO practice are our reasoning, not a statement by a source.