# Multi-Agent Systems

> Techniques for exploiting trust boundaries between AI agents, covering prompt injection, task hijacking, and lateral movement across multi-agent pipelines.

- **URL:** https://hackindex.io/platforms/ai/exploitation/multi-agent-systems
- **Path:** AI Platforms > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/ai/exploitation.md)
- **Published:** 2026-03-18
- **Updated:** 2026-09-17

Multi-agent systems chain multiple AI models together, with each agent handling a specific task and passing results to the next. An orchestrator agent coordinates subordinate agents, tool-calling agents execute actions, and retrieval agents supply context. The agents communicate through message passing, shared memory stores, and structured output schemas.

Trust between agents is the central attack surface. Agents that accept instructions from other agents without cryptographic verification or authorization checks can be manipulated by any party that can inject content into the communication channel: including users, external content retrieved by the pipeline, or a compromised upstream agent.

- Intercepting and modifying inter-agent messages in transit
- Spoofing agent identity to send unauthorized instructions
- Poisoning shared memory to influence decisions across agent boundaries
- Corrupting pipeline outputs so downstream agents act on false data
- Exploiting delegated trust where sub-agents inherit orchestrator permissions

## Pages in This Section

**Message Manipulation in Multi-Agent Workflows** covers intercepting and modifying messages passed between agents to redirect task execution, inject false results, and cause downstream agents to act on attacker-controlled data.

**Agent Impersonation in A2A Communication** covers spoofing agent identity in agent-to-agent communication protocols to send unauthorized instructions that the receiving agent treats as coming from a trusted peer.

**Workflow Corruption Through Agent Output Injection** covers poisoning the output of one agent in a pipeline to corrupt the inputs of subsequent agents, propagating malicious instructions or data through the full workflow chain.

**Exploiting Delegated Trust Between Agents** covers abusing trust relationships where a subordinate agent inherits permissions from an orchestrator, using that delegated trust to perform actions the attacker cannot trigger directly.

**Abusing Shared Memory in Multi-Agent Systems** covers writing malicious entries to shared memory stores that are read by other agents in the pipeline, poisoning the shared context to influence agent decisions and inject instructions across agent boundaries.

## Steps

- [Abusing Shared Memory and State in Multi-Agent Systems](https://hackindex.io/platforms/ai/exploitation/multi-agent-systems/abusing-shared-memory-in-multi-agent-systems.md)
- [Agent Impersonation in A2A Communication](https://hackindex.io/platforms/ai/exploitation/multi-agent-systems/agent-impersonation-in-a2a-communication.md)
- [Exploiting Delegated Trust Between Agents](https://hackindex.io/platforms/ai/exploitation/multi-agent-systems/exploiting-delegated-trust-between-agents.md)
- [Message Manipulation in Multi-Agent Workflows](https://hackindex.io/platforms/ai/exploitation/multi-agent-systems/message-manipulation-in-multi-agent-workflows.md)
- [Workflow Corruption Through Agent Output Injection](https://hackindex.io/platforms/ai/exploitation/multi-agent-systems/workflow-corruption-through-agent-output-injection.md)