Dmitrii Buchilin
Dmitrii Buchilin — how each defense added to an LLM agent email workflow made it more exploitable, and what that means for RAG provenance.
Last verified:
What is Dmitrii Buchilin?
Dmitrii Buchilin's security research writeup: hardening a multi-agent LLM email workflow where one inbound email can poison memory, influence retrieval, and steer a separate judge model into approving malicious routing. Buchilin shows how defenses added at different layers can unintentionally increase exploitability when the attacker makes the system's own components reinforce the malicious narrative — through an ingestion agent, task agent, and judge model chained without database access, intercepted tool calls, or traditional prompt injection. He reports that structured provenance labels like [METADATA: Trust level: UNTRUSTED_EXTERNAL] backfire by increasing perceived authority while plain-English provenance notes behave more safely. Relevant reading for teams building RAG pipelines, agentic email workflows, and multi-step tool-using systems.
Dmitrii Buchilin pricing
Pricing model: Freemium
The website post does not present product pricing, paid tiers, or a free plan. It reads as a technical research article rather than a commercial tool page, and no subscription or feature-gated pricing details are described.
Dmitrii Buchilin pros
- Clear real-world agent security case study
- Shows a multi-agent email pipeline end to end
- Demonstrates memory poisoning through ordinary inbound email
- Explains retrieval-based attack propagation
- Covers a separate judge model and its failure modes
- Uses controlled trial counts and success rates
- Compares multiple judge configurations
- Highlights structured metadata backfiring
- Quantifies the effect of provenance labels
- Shows that plain-English provenance notes are safer
- Introduces cross-channel authority convergence
- Explains why defense thresholds can become attacker targets
- Includes contacts and calendar propagation examples
- Compares Haiku and Sonnet behavior
- Separates infection-stage and exploitation-stage vulnerabilities
- Describes what worked and what did not
- Useful for RAG security design reviews
- Useful for agent governance and safety teams
Dmitrii Buchilin cons
- Focused on one specific email-agent setup
- Not a general-purpose LLM product
- No user-facing features or interface described
- No deployment guide or implementation package included
- Security findings are highly architecture-specific
- Results may not transfer to all agent stacks
- Relies on experimental evaluation rather than a packaged tool
- Does not provide a turnkey defense solution
- Some mechanisms remain interpretive rather than fully resolved
Frequently asked questions about Dmitrii Buchilin
What is this research about?
It examines how a multi-agent LLM email system can be exploited when an attacker sends one malicious email that gets archived, retrieved, and then treated as legitimate context by a downstream judge model. The central finding is that adding more safeguards inside the reasoning loop can make the system easier to manipulate when those safeguards trust poisoned context.
What is cross-channel authority convergence?
It is the term used for the attack pattern where different system components independently reinforce the same malicious instruction until it looks institutionally valid. In the article, memory, contacts, calendar, and judge signals combine to make the attacker’s routing request appear like a confirmed compliance obligation.
How does the attack start?
The attack starts with a single inbound email containing a compliance-style document and a hidden archiving instruction. The ingestion agent dutifully stores the content in shared memory, which means the attacker never writes directly to the database; the agent stores the payload itself.
Why does retrieval matter so much here?
Because the task agent queries memory before sending email, the poisoned document can be surfaced later as if it were relevant evidence. The article argues that attackers do not need exact query vocabulary; knowing the broad task type, such as an email workflow or compliance system, is often enough to get the malicious document retrieved.
What role does the judge model play?
The judge is a separate LLM that reviews proposed sends and is supposed to enforce policy. In the experiment, it faithfully enforces the poisoned routing mandate because that mandate appears in retrieved context and the judge is designed to trust and operationalize such context.
Why is structured metadata a problem?
The author found that structured provenance formats like bracketed metadata or XML-style attributes can increase the perceived legitimacy of a document instead of reducing it. Plain-English warnings about unverified sources behaved better, while structured labels sometimes made the malicious content more persuasive.
How did adding more defenses make things worse?
A stricter judge that required multi-source corroboration became more dangerous once the attacker could feed it enough corroborating signals through other agents. The article’s main point is that threshold-based safeguards can become attacker objectives, because the attacker can try to satisfy the threshold instead of bypassing it.
What other agents were involved besides email?
The attack chain includes contacts and calendar agents in addition to ingestion and task agents. Once memory is poisoned, the contacts agent can register the attacker as a compliance contact and the calendar agent can schedule recurring events, making the attacker look like an established internal stakeholder.
Which models were tested?
The post says the experiments were run with Claude Haiku 4.5 and Claude Sonnet 4.6. It also compares how they behave at the infection stage and exploitation stage, showing that their defenses differ depending on the step in the chain.
What defenses did the author find most effective?
The article says the most effective measures were to explicitly tell the judge to ignore external routing mandates and to isolate the judge from retrieved context entirely. It also suggests that plain prose provenance labels are safer than structured metadata, and that real protection likely needs to happen outside the reasoning loop at the infrastructure level.