Title: MURMUR: Using cross-user chatter to break collaborative language agents
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Language Agents, Security, LLM

Abstract: Language agents are rapidly expanding from single-user assistants to multi-user collaborators in shared workspaces. However, today's language models lack a mechanism for isolating user interactions and concurrent tasks, creating a new attack vector inherent to this new setting: cross-user poisoning (CUP). In a CUP attack, an adversary injects ordinary-looking messages that poison the persistent, shared state, which later triggers the agent to execute unintended, attacker-specified actions on behalf of benign users. We validate CUP on real systems, successfully attacking popular multi-user agents. To study the phenomenon systematically, we present MURMUR, a framework that composes single-user tasks into concurrent, group-based scenarios using an LLM to generate realistic, history-aware user interactions. We observe that CUP attacks succeed at high rates and their effects persist across multiple tasks, thus posing fundamental risks to multi-user LLM deployments. Finally, we introduce a first-step defense with task-based clustering to mitigate this new class of vulnerability.

TL;DR: We explore a new attack vector on Language agents communicating with multiple users and solving multiple tasks