MURMUR: Using cross-user chatter to break collaborative language agents in groups

TL;DR

The paper identifies cross-user poisoning (CUP) as a fundamental security risk in multi-user language agents, where persistent shared context enables adversaries to influence benign users across concurrent tasks. It formalizes CUP, demonstrates attacks on real-world agents, and introduces MURMUR, a framework that turns single-user benchmarks into scalable multi-user, multi-task evaluations using LLM-based user simulators. Empirical results show high attack success and persistence under concurrency, with CUP outperforming traditional prompt-injection defenses and degrading task utility. As a first defense, the authors propose task-based clustering to contain cross-task leakage, while outlining limitations and future work in strengthening defenses and extending security policies for collaborative AI systems.

Abstract

Language agents are rapidly expanding from single-user assistants to multi-user collaborators in shared workspaces and groups. However, today's language models lack a mechanism for isolating user interactions and concurrent tasks, creating a new attack vector inherent to this new setting: cross-user poisoning (CUP). In a CUP attack, an adversary injects ordinary-looking messages that poison the persistent, shared state, which later triggers the agent to execute unintended, attacker-specified actions on behalf of benign users. We validate CUP on real systems, successfully attacking popular multi-user agents. To study the phenomenon systematically, we present MURMUR, a framework that composes single-user tasks into concurrent, group-based scenarios using an LLM to generate realistic, history-aware user interactions. We observe that CUP attacks succeed at high rates and their effects persist across multiple tasks, thus posing fundamental risks to multi-user LLM deployments. Finally, we introduce a first-step defense with task-based clustering to mitigate this new class of vulnerability

Figures (10)

• Figure 1: Example of cross-user poisoning attack. (Left) In a single-user setting, an agent with prompt injection defenses detects a malicious instruction hidden within a document. (Right) In a multi-user setting, an attacker injects a malicious rule, which bypasses defenses, propagates across tasks and is eventually executed by the agent for other benign users. A demonstration of this attack on a real-world agent is detailed in Section \ref{['sec:case-study']}.
• Figure 1: ASR(%) comparing PI with CUP. PI is largely ineffective
• Figure 2: Successful CUP on Continua. Mallory's malicious link is present in the actual reminder.
• Figure 3: Workflow of the MURMUR framework. Multi-user tasks are built from single-user tasks and combined into a Task Pool (steps 1--2), simulating concurrent and independent tasks. The agent engages in chat sessions with interleaved requests (step 3), where user messages are auto-generated by an LLM. To test security, a cross-user poisoning attack is injected (step 4). Agent outputs on both benign and attack scenarios are then evaluated for utility and robustness (step 5).
• Figure 4: Tasks across environments.