REVIEW 22 cited by
Multi-Agent Systems Execute Arbitrary Malicious Code
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Multi-Agent Systems Execute Arbitrary Malicious Code
read the original abstract
Multi-agent systems coordinate LLM-based agents to perform tasks on users' behalf. In real-world applications, multi-agent systems will inevitably interact with untrusted inputs, such as malicious Web content, files, email attachments, and more. Using several recently proposed multi-agent frameworks as concrete examples, we demonstrate that adversarial content can hijack control and communication within the system to invoke unsafe agents and functionalities. This results in a complete security breach, up to execution of arbitrary malicious code on the user's device or exfiltration of sensitive data from the user's containerized environment. For example, when agents are instantiated with GPT-4o, Web-based attacks successfully cause the multi-agent system execute arbitrary malicious code in 58-90\% of trials (depending on the orchestrator). In some model-orchestrator configurations, the attack success rate is 100\%. We also demonstrate that these attacks succeed even if individual agents are not susceptible to direct or indirect prompt injection, and even if they refuse to perform harmful actions. We hope that these results will motivate development of trust and security models for multi-agent systems before they are widely deployed.
Forward citations
Cited by 22 Pith papers
-
From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems
A new 'Telephone Loop' attack stalls multi-agent web systems in delegation cycles, succeeding in about 80% of baseline runs for three frontier models while failing against single-agent systems.
-
Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety
Decomposing multi-agent LLM pipeline safety into operational reframing, planner behavior, and approval-framed delegation reveals that raw-direct model rankings mispredict deployed behavior.
-
Sequential Behavioral Watermarking for LLM Agents
SeqWM embeds watermarks into history-conditioned action transitions in LLM agent trajectories and verifies them position-agnostically, achieving robust detection under perturbations where prior per-step methods fail.
-
ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection
ARGUS cuts context-aware prompt-injection success from 28.8% to 3.8% on AgentLure while keeping 87.5% clean utility, beating prior defenses on the security-utility tradeoff.
-
Conjunctive Prompt Attacks in Multi-Agent LLM Systems
Conjunctive prompt attacks split adversarial elements across agents and routing paths in multi-agent LLM systems, evading isolated defenses and succeeding through topology-aware optimization.
-
AgentMark: Utility-Preserving Behavioral Watermarking for Agents
AgentMark watermarks agent planning behaviors with multi-bit identifiers via conditional sampling that preserves utility and works on black-box systems.
-
When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems
Prompt injection can hijack LLM-based multi-agent robot planners, propagate from one agent to clean teammates through the shared prompt, and survives per-agent AI call separation via shared memory.
-
When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems
Prompt injection can hijack multi-agent LLM robot planners, spread from an injected agent to clean teammates through shared prompts, and partially survives a per-agent separation defense via shared memory.
-
Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems
Changing one LLM agent's secret objective in Werewolf lowers its team's win rate and changes its reasoning, while its public chat stays deceptively normal.
-
Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents
Cross-agent asynchronous attack sessions can be linked at 0.82 pairwise AUC from proxy-visible tool-use and prompt-style residue in the authors' synthetic SCD-v1 benchmark, far above adapted per-session detectors and ...
-
MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems
MESA ranks MAS communication edges by vulnerability via graph-theoretic metrics and dynamic probes, achieving mean Spearman ρ=+0.60 correlation with empirical per-edge attack success and 3x interception gain when moni...
-
The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
No major agentic AI framework complies with six safety containment principles; a memory poisoning attack on LangChain causes persistent targeted errors up to 88.9% wrongful denials and 3.5x increase under complex poli...
-
"I Strongly Suspect This Website Is a Scam": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents
New benchmark Scammer4U finds 54-93% critical PII leakage from frontier web agents on scam sites versus 0% on benign twins, plus a 30-point gap between verbalized suspicion and actual submission.
-
When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks
Multi-agent LLM frameworks can spread compromises across agent boundaries via insecure memory inheritance during subagent spawning.
-
ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection
ARGUS defends LLM agents from context-aware prompt injections by tracking information provenance and verifying decisions against trustworthy evidence, reducing attack success to 3.8% while retaining 87.5% task utility.
-
Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines
A single legitimate request can cause LLM orchestrators to output plans that violate security policies through the composition of benign subtasks, bypassing subtask-level checks.
-
Security Considerations for Multi-agent Systems
No existing AI security framework covers a majority of the 193 identified multi-agent system threats in any category, with OWASP Agentic Security Initiative achieving the highest overall coverage at 65.3%.
-
From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration
A graph-based propagation model for error cascades in LLM multi-agent systems plus a genealogy-graph governance plugin that prevents final infection in at least 89% of runs across tested frameworks.
-
Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs
In multi-agent LLM systems, denser communication topologies, shorter attacker-target distances, and higher target centrality increase the leakage of private information, with most leakage occurring in early interactio...
-
Detailed analysis of possible new-physics effects in the semileptonic decay $B_s \to D_s^{(*)}\tau\bar{\nu}$
Constraints on beyond-SM Wilson coefficients in B_s → D_s(*) τ ν̄ are derived from data using covariant-quark-model form factors, with full observable predictions for future experiments.
-
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
A synthesis of 247 papers on LLM agent security identifies prompt injection and tool hijacking as dominant threats, notes weakly compositional defenses, and argues for trust boundaries and realistic evaluations.
-
Challenges and Future Directions in Agentic Reverse Engineering Systems
Agentic LLM systems for reverse engineering fail on obfuscation, timing, and unique architectures due to token limits and missing guardrails, with challenges and directions proposed.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.