Multi-Agent Systems

Multi-agent systems chain multiple AI models together, with each agent handling a specific task and passing results to the next. An orchestrator agent coordinates subordinate agents, tool-calling agents execute actions, and retrieval agents supply context. The agents communicate through message passing, shared memory stores, and structured output schemas.

Trust between agents is the central attack surface. Agents that accept instructions from other agents without cryptographic verification or authorization checks can be manipulated by any party that can inject content into the communication channel — including users, external content retrieved by the pipeline, or a compromised upstream agent.

Pages in This Section

Message Manipulation in Multi-Agent Workflows covers intercepting and modifying messages passed between agents to redirect task execution, inject false results, and cause downstream agents to act on attacker-controlled data.

Agent Impersonation in A2A Communication covers spoofing agent identity in agent-to-agent communication protocols to send unauthorized instructions that the receiving agent treats as coming from a trusted peer.

Workflow Corruption Through Agent Output Injection covers poisoning the output of one agent in a pipeline to corrupt the inputs of subsequent agents, propagating malicious instructions or data through the full workflow chain.

Exploiting Delegated Trust Between Agents covers abusing trust relationships where a subordinate agent inherits permissions from an orchestrator, using that delegated trust to perform actions the attacker cannot trigger directly.

Abusing Shared Memory in Multi-Agent Systems covers writing malicious entries to shared memory stores that are read by other agents in the pipeline, poisoning the shared context to influence agent decisions and inject instructions across agent boundaries.