Exploiting Delegated Trust Between Agents

Orchestrators delegate tasks to sub-agents by passing instructions and context. Sub-agents typically have no mechanism to verify that the entity sending them instructions is actually their legitimate orchestrator. They operate on an implicit trust model: anything arriving on their input channel is treated as a trusted instruction. This trust can be abused from two directions: by impersonating the orchestrator to issue unauthorized instructions, or by compromising the orchestrator itself and using its trusted position to instruct sub-agents to perform actions outside their intended scope.

Delegated trust exploitation paths in multi-agent systems:

• Prompt injection into the orchestrator to issue instructions to sub-agents
• Cross-scope abuse where a sub-agent executes tasks outside its defined role
• Trust transitivity through deep agent hierarchies (orchestrator to sub-agent A to sub-agent B)
• Task authorization bypass where sub-agents accept any instruction from a trusted source

Delegated Trust Agent Exploitation via Injection

Compromise the orchestrator via prompt injection and use its privileged position to issue instructions to sub-agents it normally would not send:

If the orchestrator passes this instruction to the code agent without validating whether the user is authorized to issue code execution commands, the delegated trust from orchestrator to sub-agent is exploited. The user gains code execution capabilities they should not have by routing through the orchestrator's trusted relationship with the executor.

Exploit Scope Boundaries Between Agent Roles

Sub-agents are often scoped to specific task types but accept instructions from the orchestrator without checking whether the requested task falls within their intended scope. Test whether a research agent will execute tasks meant for the code or executor agent:

Exploit Trust Transitivity

In deep agent hierarchies, trust propagates through multiple levels. An orchestrator trusts sub-agent A, sub-agent A trusts sub-agent B, and so on. Compromising any link in the chain gives influence over everything downstream:

Test Whether Sub-Agents Validate Task Authorization

Send a task to a sub-agent that falls clearly outside its documented purpose to check whether it enforces scope:

An incoming connection on the listener confirms the sub-agent executed the out-of-scope instruction because it came from the orchestrator's trusted position. The sub-agent performed a network call that has nothing to do with its summarization role, demonstrating that delegated trust is not bounded by role scope.