Single Points of Failure in Multi-Agent Workflows
Multi-agent systems introduce architectural patterns that concentrate risk. A shared memory store that all agents read from means a single poisoned entry affects every agent in the system. A centralised orchestrator that all tasks route through means compromising it gives control over the entire workflow. An API key shared across all agents means recovering it provides access to every capability the system has. Identifying these concentration points before attacking determines which techniques produce system-wide impact rather than localised effects.
Identify Shared Memory and State
Determine whether agents share a common memory or state store. A shared store means poisoning it once affects all agents:
If a fact written into memory via one agent is retrievable by another agent in a separate request, memory is shared across the system. This is the highest-impact single point of failure — a single memory write poisons all agents simultaneously.
Identify the Orchestrator as a Central Control Point
Test whether the orchestrator validates or sanitises sub-agent outputs before acting on them. A vulnerable orchestrator that blindly trusts sub-agent responses is a system-wide failure point:
An orchestrator that executes instructions found in sub-agent search results or retrieved documents is vulnerable to indirect prompt injection cascading through the entire workflow. A single malicious document in the search results or knowledge base can compromise the full agent chain.
Identify Shared Tool Credentials
If all agents share the same API credentials for external tools, recovering those credentials gives system-wide tool access. Check whether tool credentials are agent-specific or shared:
Identify the RAG Knowledge Base as a Shared Dependency
When all agents draw from the same vector store, poisoning that store affects every agent's knowledge simultaneously. Confirm whether the knowledge base is shared:
Document Single Points of Failure
Compile findings into a risk-ordered list for the exploitation phase:
# Single Points of Failure — Risk Ordered
1. SHARED MEMORY STORE
Risk: Critical — single write poisons all agents
Confirmed: Yes — fact written via agent A retrievable by agent B
Attack: Memory poisoning via any agent interface
2. ORCHESTRATOR TRUST IN SUB-AGENT OUTPUT
Risk: High — indirect injection cascades to full workflow
Confirmed: Partial — orchestrator executes tool results without validation
Attack: Poison search results or retrieved documents
3. SHARED VECTOR STORE
Risk: High — single poisoned document affects all RAG queries
Confirmed: Yes — all agents query same Chroma collection
Attack: RAG poisoning if write access obtained
4. SHARED API CREDENTIALS
Risk: Medium — single credential recovery gives full tool access
Confirmed: Unknown — requires further probing
Attack: Credential extraction via prompt injection
References
-
OWASP Top 10 for LLM Applicationsowasp.org/www-project-top-10-for-large-language-model-applications (opens in new tab)
LLM09: Misinformation and LLM04: Data and Model Poisoning reference
-
Microsoft — Automated Security Assessment Frameworkwww.microsoft.com/en-us/security/blog/2024/02/22/announcing-microsofts-open-automation-security-framework (opens in new tab)
Multi-agent trust boundary and shared state risk analysis
Was this helpful?
Your feedback helps improve this page.