ATK-014 Tool & agent abuse
Multi-Agent Collusion
Applies to: Agentic AI · Last reviewed 2026-05-01
Prerequisites
- System employs multiple agents that exchange messages, delegate tasks, or share state.
- Inter-agent trust is implicit (an agent does not authenticate messages from other agents).
Test approach
With written authorization in a non-production environment, the tester injects messages into one agent that cause it to instruct another agent to perform actions outside the second agent's normal scope. Variations include: spoofed-orchestrator messages, retrieval-poisoned context shared across agents, and emergent task-delegation chains.
Expected evidence
- Inter-agent message logs.
- Trace of the chain of actions across agents.
- Evidence of the resulting unauthorized action.
Detection signals
- Inter-agent messages whose content does not match observed user intent.
- Action chains crossing multiple agents within seconds.
- Out-of-band messaging to agents not invoked by the user.
Defensive recommendations
- Authenticate inter-agent messages; treat unauthenticated messages as untrusted.
- Apply least-privilege per agent; do not let agents act on behalf of other agents without explicit delegation tokens.
- Log inter-agent communication with provenance for audit.
Framework mappings
- OWASP LLM Top 10: LLM07:2025
- OWASP Agentic Top 10: AAI03, AAI06
- MITRE ATLAS: AML.T0067
- NIST AI RMF: MANAGE-2.2
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.