Multi-agent security patterns, isolation, and trust boundaries
Newest first · 5 reviewed on this page
Search insteadRuxue Shi, Yili Wang, Mengnan Du +4
LLM-based multi-agent systems (MAS) solve complex tasks through inter-agent collaboration, but their communication-driven nature also allows security risks to spread across agents and trigger system-wide failures. Existing MAS defenses mainly follow a reactive paradigm after…
Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon +2
Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities…
Abdullah X
AI agents increasingly work inside systems that govern how they delegate tasks, move information, execute actions, and use shared resources. Recent work already shows that deployment rules can change collective behavior. Here we ask which parts of an AI institution produce…
Xabier Muruaga
LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an…
Manoj N M, Vijayakrishna S, Manjunath Srinivas +1
This paper proposes a multi-agent framework built on CrewAI [1] for conversational business intelligence. Five specialized AI agents operate in a sequential pipeline to process natural language queries, retrieve and analyze data, generate visualizations via the Model Context…
Tongyan Hu, Bryan Hooi
Large language models (LLMs) remain vulnerable to jailbreak attacks that exploit techniques such as role-playing, obfuscation, code transformation, and multi-step indirection to elicit harmful outputs. As jailbreak strategies keep emerging, defenses have proliferated in an…
Rui Yang, Junjie Xu, Zhengyu Liu +4
Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of…
Ziwei Zhao, Yu Gu, Haojun Liang +2
AI coding agents are evolving from solitary tools into collaborative teammates that discover and invoke one another's specialized skills. But the coordination channel itself can leak a skill's intellectual property. Protocols such as MCP and A2A run implementations server-side,…
Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi
Autonomous LLM agents increasingly act on a user's behalf: they hold credentials, call tools and services, and spawn sub-agents that act further on their behalf. This turns a long-standing distributed-systems question -- who is authorized to do what, on whose authority -- into…
Lifei Liu, Haoran Yu
Multi-agent applications delegate work across independently operated deployers. After an incident, a verifier must answer two questions: which deployer released the reported bytes, and whether each cross-deployer edge was authorized. Credentials establish who may act, but need…
Ashok Subbabhatta Gopalakrishna
Multi-agent AI platforms move quickly from staging to production, but the way agents establish trust remains rudimentary: an agent either transmits raw data to a peer or accepts that peer's natural-language self-report that a value complies with policy. The first over-shares;…
Alessandro Pesare, Tommaso Dolci, Katja Hose +1
The emergence of agentic AI and LLM-based multi-agent systems (MAS) presents unprecedented opportunities for automating complex tasks, while simultaneously raising critical concerns about the preservation of fundamental human-centered values, such as privacy, fairness, and…
Jinxi Yu, Eric Hanchen Jiang, Levina Li +6
Topology-guided safeguards for LLM-based multi-agent systems (MAS) train a GNN over the inter-agent communication graph to localize risky agents and intervene on the topology---but they assume one operator can pool all labeled traces. Across organizations that assumption breaks:…
Rasmus Moorits Veski, Rachid Guerraoui, David Froelicher
Agentic systems require secure and efficient delegation of privileges across multiple collaborating agents. Existing approaches fall into two categories. Some propagate user identities directly to agents, obscuring accountability and creating persistent over-privilege risks that…
Chaoyu Zhang, Hexuan Yu, Heng Jin +6
Agentic AI systems execute complex tasks through long-horizon workflows of planning, tool use, and multi-agent coordination. Task failures in these systems often originate from a single step, such as an injected prompt or a flawed plan, and are then amplified through downstream…
Alireza Lotfi, Mirza Masfiqur Rahman, Imtiaz Karim +1
The Agent2Agent (A2A) protocol, now governed by the Linux Foundation, is an open standard that enables autonomous AI agents to discover, authenticate with, and delegate tasks to one another across organizational boundaries. Designed to complement the Model Context Protocol (MCP)…
Elias Stengel-Eskin, Newton Sander, Carlos Bonetti +4
The growing rate at which LLM agents interact with one another raises key questions about language evolution in multi-LLM-agent settings, with implications for safety and monitorability as well as for linguistic accounts of LLMs. To address these questions, we introduce…
Xuanfa Jin, Zhijian Ma, Yongcheng Zeng +3
Multi-agent debate (MAD) improves the reasoning capabilities of large language models by having multiple agents iteratively refine their responses through discussion. However, MAD suffers from a critical vulnerability known as shared misconception: when a majority of agents…
Michael Ray Johnson, Linda Naimi
No specification says how a governed autotelic AI agent organization, where agents pursue self-generated goals inside guardrails, should be designed and evaluated. We answer in two parts. First, we synthesize the Governed Autotelic Multi-Agent Product Organization (GAMPO)…
Yian Wang, Agam Goyal, Eshwar Chandrasekharan +1
Multi-agent LLM systems often coordinate by compressing an upstream interaction into a handoff artifact that downstream agents treat as shared state. We show that this handoff step is a structural source of privacy leakage: summaries preferentially preserve operational facts…
CheolWon Na, Hao Ni, Lukasz Szpruch +7
LLM-based multi-agent trading systems, in which specialized agents collaborate through structured communication to produce trading decisions, are moving rapidly from research prototypes to live deployments that control real assets. The same inter-agent communication that makes…
Víctor Manuel González-Gorrín, Josep Prieto-Blázquez
Multi-agent AI systems have emerged as a promising approach for metamorphic malware detection, combining large language model (LLM) reasoning with specialized static, dynamic, and similarity-analysis tools. The cryptographic security of the supporting infrastructure –…
Pramod Prakash
Security operations centers face challenges in managing complex cyber incidents while protecting sensitive forensic data. This paper introduces a multi-agent LLM framework for automating incident response through collaborative planning, execution, analysis, and reflection. We…
Michael Ominyi
Organizations in pharmaceutical, financial, and other regulated sectors face rising pressure to review large volumes of complex documents against strict and frequently evolving standards, while preserving the traceability needed to defend decisions to auditors and regulators.…
Xing Zhang, Ya Cui, Guanghui Wang +1
Long-form research reports generated by large language models drift, contradict themselves, and lose provenance: the same metric appears with different values, and rumor is quoted as confidently as an audited filing. We present a two-tier agentic system that separates a…
Ming Cong, Jingyin Chen, Bin Liu +4
Deployed LLM safety guardrails are predominantly static: trained once and frozen at release, while new jailbreak techniques and previously un-addressed harmful categories emerge within days, leaving the defense perpetually a step behind. We present SESG (Self-Evolving Safety…
Rodrigo Tavares de Pina Simões, Xavier Larriva-Novo, Carmen Sánchez-Zas +2
Security Operations Centers (SOCs) rely on Level 1 analysts to triage increasing alert volumes amid alert fatigue and tool fragmentation. LLM-based multi-agent systems using the Model Context Protocol (MCP) are being adopted to automate these tasks, but their autonomy and tool…
Jiahao Xiao, Lei Feng, Min-Ling Zhang
LLM-based multi-agent systems (MAS) extend LLM capabilities through iterative communication and shared contexts. However, this collaboration introduces a vulnerability: backdoor behavior can be activated when peer evidence reaches a hidden threshold, rather than being determined…
Wen-Jun Xiong, Yi-Jin Zhou, Jia-Qian Wang +6
LLM-based multi-agent systems (MAS) increasingly rely on persistent private and shared memories for long-horizon coordination. This memory layer improves continuity, but it also gives attackers a durable channel: a poisoned memory can be written once, continuously retrieved in…
Santipong Thaiprayoon, Phattharat Songthung
Large Language Models (LLMs) show promise in healthcare, but single-model systems often suffer from hallucinations, lack transparency, and have limited clinical safety. We present MedCouncil, a multi-agent framework designed to serve as a second-opinion tool for general internal…
Shreya Singh
GraphShield is a graph-structured defense framework for LLMs that represents system prompts, retrieved knowledge, agents, and parsed instructions as directed Trust-Knowledge Graph (TKG). Security is formalized as reachability from an instruction node to policy node in a…
Haochuan Wang, Zechen Zhang
Multi-agent LLM systems are entering productionprocessing documents, managing workflows, acting on behalf of users-yet their resilience to prompt injection is still evaluated with a single binary: did the attack succeed? This leaves architects without the diagnostic information…
Shaina Raza, Ranjan Sapkota, Manoj Karkee +1
Agentic AI systems, built upon large language models (LLMs) and deployed in multi-agent configurations, are redefining intelligence, autonomy, collaboration, and decision-making across enterprise and societal domains. This review presents a structured analysis of Trust, Risk,…
I. Habler, Ken Huang, Vineeth Sai Narajala +1
As Agentic AI systems evolve from basic workflows to complex multi-agent collaboration, robust protocols such as Google’s Agent2Agent (A2A) become essential enablers. To foster secure adoption and ensure the reliability of these complex interactions, understanding the secure…
Rui Miao, Yixin Liu, Yili Wang +5
The security of LLM-based multi-agent systems (MAS) is critically threatened by propagation vulnerability, where malicious agents can distort collective decision-making through inter-agent message interactions. While existing supervised defense methods demonstrate promising…
Yinuo Xue, Eric Spero, Yun Sing Koh +1
Jinyu Chen, Jixiao Yang, Ziyang Zeng +3
Large Language Model (LLM)-based multi-agent systems have demonstrated remarkable capabilities across diverse applications, yet they face critical security challenges including backdoor attacks, prompt injection, and privacy leakage. Existing defense mechanisms typically address…
S. Hossain, Ruksat Khan Shayoni, Mohd Ruhul Ameen +3
Prompt injection attacks represent a major vulnerability in Large Language Model (LLM) deployments, where malicious instructions embedded in user inputs can override system prompts and induce unintended behaviors. This paper presents a novel multi-agent defense framework that…
Diego Gosmar, Deborah A. Dahl
This paper proposes a novel architectural framework aimed at enhancing security and reliability in multi-agent systems (MAS). A central component of this framework is a network of Sentinel Agents, functioning as a distributed security layer that integrates techniques such as…
Yedidel Louck, Ariel Stulman, Amit Dvir
Multi-agent systems (MAS) powered by artificial intelligence (AI) are increasingly foundational to complex, distributed workflows. Yet, the security of their underlying communication protocols remains critically under-examined. This paper presents the first empirical,…
A. Asad, Stephen Obadinma, Radin Shayanfar +1
We introduce RedDebate, a novel multi-agent debate framework that provides the foundation for Large Language Models (LLMs) to identify and mitigate their unsafe behaviours. Existing AI safety approaches often rely on costly human evaluation or isolated single-model assessment,…
Vaishali Vinay
Cybersecurity operations are increasingly adopting agentic AI solutions due to the time-critical and complex decision-making in security operations centers (SOCs). While large language models (LLMs) are good with summarization tasks or interpreting structured and unstructured…
Sunil Kumar Jang Bahadur, Gopala Dhar
Generative Artificial Intelligence (GenAI) presents significant advancements but also introduces novel security challenges, particularly within agentic workflows where AI agents operate autonomously. These risks escalate in multi-agent systems due to increased interaction…
OWASP GenAI Security Project
Identifies the top 10 security risks specific to agentic AI applications including excessive agency, unsafe tool execution, and inadequate oversight.
John Yang, Carlos E. Jimenez, Alexander Wettig +4
Demonstrates autonomous coding agents that interact with computer interfaces to solve software engineering tasks, raising questions about agent containment.
Xiangming Gu, Xiaosen Zheng, Tianyu Pang +5
A multimodal large language model (MLLM) agent can receive instructions, capture images, retrieve histories from memory, and decide which tools to use. Nonetheless, red-teaming efforts have revealed that adversarial images/prompts can jailbreak an MLLM and cause unaligned…
Feng He, Tianqing Zhu, Dayong Ye +3
Surveys security and privacy challenges specific to LLM-based agents, covering agent architectures, attack surfaces, and defense mechanisms.
Miao Yu, Junfeng Fang, Yingjie Zhou +4
While safety-aligned large language models (LLMs) are increasingly used as the cornerstone for powerful systems such as multi-agent frameworks to solve complex real-world problems, they still suffer from potential adversarial queries, such as jailbreak attacks, which attempt to…
Anthropic
Documentation and analysis of security considerations for the Model Context Protocol, covering authentication, authorization, and tool sandboxing.
Anthropic
Open protocol specification for connecting AI models to external data sources and tools, enabling standardized tool use with security considerations.