If hackers share notes on what they've seen, can they figure out which traps are fake and walk around them?
Can attackers exploit pooled agent trajectories to identify and bypass defenses?
This explores whether a group of attacking agents that share what each of them saw and did can work out where the defenses are and slip past them.
This explores whether attackers who pool their agents' trajectories can learn where the defenses are and route around them. The corpus has one direct, mathematical answer for a specific kind of defense (decoys), plus several neighboring results that suggest why the same logic should worry defenders more broadly. It has no study of attackers mining pooled trajectories to find defensive gaps in general.
The direct result is that Does sharing observations help coalitions detect decoys better? shows that when agents share their observations, the group's ability to tell decoys from genuine objects can stay the same or improve, but never get worse. Any defense that depends on hiding, such as planting fakes and hoping an intruder wastes effort on them, loses value as the intruders compare notes. Keeping agents isolated from each other does not protect the decoys from a coordinated group.
The broader worry is that most defenses judge one thing at a time, and pooled trajectories supply the missing context. Can a model-level filter truly contain an agent with environment access? points out that a filter judges a single output at one moment, while an agent's risk spreads across memory, tool calls, and environment. Can task decomposition hide harmful intent across agents? shows harm split into steps that each look benign, with the problem visible only in combination. Several attacks also target places where defenses don't look. Can prompts alone reshape multi-agent workflows without system access? steers workflows before inspection defenses activate. Can attackers manipulate which model handles a request? sits beneath prompt-level defenses. Can one compromised agent corrupt an entire multi-agent network? slips past paraphrasing defenses because the bias has no explicit content to paraphrase away. Groups of agents could use each other's outcomes to find these gaps. That is my inference from these notes rather than something any of them tests.
Defenders can pool too, and the corpus argues they should. Should defence units span multiple executions and agents? says the unit of defense should be a revisable set of actions linked by transfers and task authority, not one isolated execution. Can semantic labels on requests prevent malicious propagation through agent networks? carries the original request's risk labels downstream so fragmentation can't strip them. How can operators stop coordinated agent intrusions now? adds limits on the shared resources agents can reach. The asymmetry is that attackers pool by design, while defenders have to reconstruct which actions belong together. Can defenders discover agent episodes without knowing membership in advance? names that reconstruction as the central unsolved problem and reports no conclusive result on whether it can be done at acceptable false-alert costs.
One caution comes from Does a multi-agent setting automatically signal a security effect?: having many agents doesn't automatically create a new security problem. Only amplification, composition, or genuinely new properties count as multi-agent effects. Pooling passes that test, because it can only strengthen the attackers' observations. Can agents be tricked into delegating work in circles? is another attack that needs multiple agents to exist at all. So the answer is yes for hiding-based defenses like decoys, and probably yes for defenses that review one execution at a time. Whether attackers exploit this in practice is not yet shown.
Sources 12 notes
Mathematical analysis shows that when agents share their observations, the coalition's capacity to distinguish decoys from genuine objects cannot decrease—it stays the same or improves. This means defenders cannot rely on isolation to hide decoys from coordinated observers.
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
FLOWSTEER demonstrates that a crafted prompt can steer planner-executor systems by biasing workflow formation before infrastructure is invoked, raising malicious success by up to 55 percent. This attack surface exists because contamination enters upstream of workflow inspection defenses.
The layer deciding which model handles a request sits beneath prompt-level defenses and is vulnerable to manipulation and unverified provenance. Attackers can exploit routing to send requests to weaker models or cause safety measures to operate on the wrong identity.
Show all 12 sources
Research demonstrates that a single biased agent can transmit persistent behavioral corruption through six downstream agents in chain and bidirectional topologies using only normal inter-agent communication. The bias evades detection and paraphrasing defenses because it carries no explicit semantic content.
The operational unit of defence should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Isolated review loses relevant context that spans multiple executions.
SafeFlow attaches structured semantic labels to root requests and propagates them through the collaboration graph as work delegated, allowing each downstream step to inherit the original intent and risk context that fragmentation removes.
The doctrine preserves relationships across executions, constrains shared resources agents can access, and ties responses to persistent state rather than closed channels. Operators can implement this through collaboration policy and permission-level testing now.
Research identifies prospective discovery—grouping actions before membership is supplied—as the key bottleneck in coordinated agent defense. The paper proposes matching known-groups and discovered-episodes arms on reviewer workload, but reports no conclusive result on whether discovery can be done at acceptable false-alert costs.
Interaction between agents can leave failures unchanged, amplify them, create them through composition, or define new properties. Only amplification, composition, and emergent properties qualify as genuinely multi-agent effects; unchanged failures reflect single-agent problems repackaged.
Research identifies a novel MAS-specific attack that weaponizes cross-agent delegation to form task cycles, distinct from applying existing attacks like prompt injection to teams. The mechanism requires multiple agents and has no single-agent counterpart.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- Agents of Chaos
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Can AI Agents Agree?