Does isolating planning from untrusted data actually stop prompt injection?

CaMeL's authors credit the Dual LLM pattern, "theoretically described by Willison (2023)," as "a significant step forward in defense strategies." It splits the agent in two: "a Privileged LLM," which plans the sequence of actions from the user's query alone and "never [sees] the content from potentially compromised data sources," and "a Quarantined LLM," which is "stripped of any tool-calling capabilities" and does the actual reading of untrusted documents. The design goal is that an injected instruction hidden in a document can influence only the quarantined half, which cannot call tools, so it "cannot call arbitrary tools with arbitrary arguments." CaMeL's authors still ask directly: "Is Dual LLM of Willison enough?" Their answer is no.

The paper's worked example shows why. The Privileged LLM plans correctly: find the meeting notes, extract the recipient's email and the document name, send it. But when the Quarantined LLM reads the meeting notes to extract those two values, "a malicious party with access to the meeting notes" has added text that influences it "to return data that causes an attacker-chosen file to be sent to an attacker-chosen address." The plan — the control flow — was never hijacked. What moved was a value inside the plan: "even if the global plan itself is not hijacked, the data being processed according to the plan is manipulated, which can cause malicious actions to be executed." Isolating who plans from who reads untrusted data does not isolate the values that reading produces from that data's influence.

This sits one layer below Can inspecting generated workflows catch planning-time attacks?, whose argument is that the plan itself can be contaminated before it is organized into a workflow. Willison's pattern already defends the layer that note is concerned with — the Privileged LLM's plan stays clean because it never touches the untrusted document. The CaMeL authors' point is that clean-plan security is not sufficient: the attack surface moves one step down, into the step-by-step data extraction the plan calls for, which is exactly where Can capability tracking stop prompt injection attacks? adds capability checks. It is also the concrete case Why do single-message classifiers miss cross-agent harms? describes abstractly: a value should carry forward where it came from as it crosses from document to extracted field to tool argument, and Willison's pattern has no mechanism to make that label travel.

The excerpt gives this as a single illustrative scenario from CaMeL's related-work discussion, not a measured attack-success rate against deployed Dual LLM systems — there is no reported frequency for how often this bypass succeeds in practice. The implication the paper draws from it is narrower and structural: isolating the planner from untrusted content secures the control flow but says nothing about the data flow, so the Dual LLM pattern alone should not be treated as a complete prompt-injection defense.