Pith. sign in

REVIEW 22 cited by

Multi-Agent Systems Execute Arbitrary Malicious Code

Not yet reviewed by Pith; the record is open.

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2503.12188 v2 pith:GTBKDWMZ submitted 2025-03-15 cs.CR cs.LG

Multi-Agent Systems Execute Arbitrary Malicious Code

classification cs.CR cs.LG
keywords multi-agentagentsmalicioussystemsarbitrarycodeattackscontent
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved
0 comments
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Multi-agent systems coordinate LLM-based agents to perform tasks on users' behalf. In real-world applications, multi-agent systems will inevitably interact with untrusted inputs, such as malicious Web content, files, email attachments, and more. Using several recently proposed multi-agent frameworks as concrete examples, we demonstrate that adversarial content can hijack control and communication within the system to invoke unsafe agents and functionalities. This results in a complete security breach, up to execution of arbitrary malicious code on the user's device or exfiltration of sensitive data from the user's containerized environment. For example, when agents are instantiated with GPT-4o, Web-based attacks successfully cause the multi-agent system execute arbitrary malicious code in 58-90\% of trials (depending on the orchestrator). In some model-orchestrator configurations, the attack success rate is 100\%. We also demonstrate that these attacks succeed even if individual agents are not susceptible to direct or indirect prompt injection, and even if they refuse to perform harmful actions. We hope that these results will motivate development of trust and security models for multi-agent systems before they are widely deployed.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 22 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems

    cs.CR 2026-07 conditional novelty 7.0

    A new 'Telephone Loop' attack stalls multi-agent web systems in delegation cycles, succeeding in about 80% of baseline runs for three frontier models while failing against single-agent systems.

  2. Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety

    cs.AI 2026-07 conditional novelty 7.0

    Decomposing multi-agent LLM pipeline safety into operational reframing, planner behavior, and approval-framed delegation reveals that raw-direct model rankings mispredict deployed behavior.

  3. Sequential Behavioral Watermarking for LLM Agents

    cs.CR 2026-05 unverdicted novelty 7.0

    SeqWM embeds watermarks into history-conditioned action transitions in LLM agent trajectories and verifies them position-agnostically, achieving robust detection under perturbations where prior per-step methods fail.

  4. ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection

    cs.CR 2026-05 conditional novelty 7.0

    ARGUS cuts context-aware prompt-injection success from 28.8% to 3.8% on AgentLure while keeping 87.5% clean utility, beating prior defenses on the security-utility tradeoff.

  5. Conjunctive Prompt Attacks in Multi-Agent LLM Systems

    cs.MA 2026-04 unverdicted novelty 7.0

    Conjunctive prompt attacks split adversarial elements across agents and routing paths in multi-agent LLM systems, evading isolated defenses and succeeding through topology-aware optimization.

  6. AgentMark: Utility-Preserving Behavioral Watermarking for Agents

    cs.CR 2026-01 unverdicted novelty 7.0

    AgentMark watermarks agent planning behaviors with multi-bit identifiers via conditional sampling that preserves utility and works on black-box systems.

  7. When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems

    cs.RO 2026-08 conditional novelty 6.0

    Prompt injection can hijack LLM-based multi-agent robot planners, propagate from one agent to clean teammates through the shared prompt, and survives per-agent AI call separation via shared memory.

  8. When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems

    cs.RO 2026-08 conditional novelty 6.0

    Prompt injection can hijack multi-agent LLM robot planners, spread from an injected agent to clean teammates through shared prompts, and partially survives a per-agent separation defense via shared memory.

  9. Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems

    cs.AI 2026-07 conditional novelty 6.0

    Changing one LLM agent's secret objective in Werewolf lowers its team's win rate and changes its reasoning, while its public chat stays deceptively normal.

  10. Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents

    cs.CR 2026-07 conditional novelty 6.0

    Cross-agent asynchronous attack sessions can be linked at 0.82 pairwise AUC from proxy-visible tool-use and prompt-style residue in the authors' synthetic SCD-v1 benchmark, far above adapted per-session detectors and ...

  11. MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems

    cs.CR 2026-06 unverdicted novelty 6.0

    MESA ranks MAS communication edges by vulnerability via graph-theoretic metrics and dynamic probes, achieving mean Spearman ρ=+0.60 correlation with empirical per-edge attack success and 3x interception gain when moni...

  12. The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements

    cs.AI 2026-06 unverdicted novelty 6.0

    No major agentic AI framework complies with six safety containment principles; a memory poisoning attack on LangChain causes persistent targeted errors up to 88.9% wrongful denials and 3.5x increase under complex poli...

  13. "I Strongly Suspect This Website Is a Scam": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents

    cs.CR 2026-05 unverdicted novelty 6.0

    New benchmark Scammer4U finds 54-93% critical PII leakage from frontier web agents on scam sites versus 0% on benign twins, plus a 30-point gap between verbalized suspicion and actual submission.

  14. When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks

    cs.CR 2026-05 unverdicted novelty 6.0

    Multi-agent LLM frameworks can spread compromises across agent boundaries via insecure memory inheritance during subagent spawning.

  15. ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection

    cs.CR 2026-05 unverdicted novelty 6.0

    ARGUS defends LLM agents from context-aware prompt injections by tracking information provenance and verifying decisions against trustworthy evidence, reducing attack success to 3.8% while retaining 87.5% task utility.

  16. Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines

    cs.CR 2026-04 unverdicted novelty 6.0

    A single legitimate request can cause LLM orchestrators to output plans that violate security policies through the composition of benign subtasks, bypassing subtask-level checks.

  17. Security Considerations for Multi-agent Systems

    cs.CR 2026-03 unverdicted novelty 6.0

    No existing AI security framework covers a majority of the 193 identified multi-agent system threats in any category, with OWASP Agentic Security Initiative achieving the highest overall coverage at 65.3%.

  18. From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration

    cs.MA 2026-03 unverdicted novelty 6.0

    A graph-based propagation model for error cascades in LLM multi-agent systems plus a genealogy-graph governance plugin that prevents final infection in at least 89% of runs across tested frameworks.

  19. Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs

    cs.CR 2025-12 conditional novelty 6.0

    In multi-agent LLM systems, denser communication topologies, shorter attacker-target distances, and higher target centrality increase the leakage of private information, with most leakage occurring in early interactio...

  20. Detailed analysis of possible new-physics effects in the semileptonic decay $B_s \to D_s^{(*)}\tau\bar{\nu}$

    hep-ph 2026-03 unverdicted novelty 4.0

    Constraints on beyond-SM Wilson coefficients in B_s → D_s(*) τ ν̄ are derived from data using covariant-quark-model form factors, with full observable predictions for future experiments.

  21. Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

    cs.CR 2026-06 unverdicted novelty 3.0

    A synthesis of 247 papers on LLM agent security identifies prompt injection and tool hijacking as dominant threats, notes weakly compositional defenses, and argues for trust boundaries and realistic evaluations.

  22. Challenges and Future Directions in Agentic Reverse Engineering Systems

    cs.CR 2026-04 unverdicted novelty 3.0

    Agentic LLM systems for reverse engineering fail on obfuscation, timing, and unique architectures due to token limits and missing guardrails, with challenges and directions proposed.