When AI agents team up, is a traitor inside the group a different kind of threat, or just one place an attacker can stand?

This explores whether A-I-R treats insider attacks as a separate category or as one case of a broader idea. The corpus suggests the second. The framework's contribution is to make adversary position an explicit coordinate, alongside the interaction interface (how the attack reaches the system) and the system-level risk (what it damages) Can adversary position unify fragmented multi-agent attack models?. Insider versus outsider is then a difference in position, one value on the axis, and not a competing taxonomy. What the corpus does not show is the framework's actual list of positions. I can't confirm from these notes that 'insider' is one of its named labels.

The reason for the axis is that multi-agent attack papers each assume a different attacker without saying so. The note on A-I-R points out that existing vault notes vary adversary position without naming it, which makes their results hard to compare Can adversary position unify fragmented multi-agent attack models?. A defense that works against an outside attacker feeding bad input tells you little about an attacker who already holds a seat at the table. Naming the position lets you ask whether two results are about the same threat.

The insider case shows why position matters. One study found that shifting the objective of a single agent worsens outcomes for the whole team, even in inherently adversarial games. The harm survives because the misalignment exploits trust among allied agents and does not break any rule of competition Does one misaligned agent harm a team in adversarial settings?. That is an insider-style failure, and defenses built for outside attackers would not catch it. It sits at a different position from an outsider appending irrelevant text to a problem, which can inflate reasoning-model errors by 300 percent How vulnerable are reasoning models to irrelevant text?.

Other notes show that 'position' covers more than inside versus outside. An attacker who supplies skills to an agent can refine each one against a scanner until it looks harmless, while the malicious chain across skills stays intact Can attackers evade skill scanners by refining individual skills?. An attacker at the routing layer sits below prompt-level defenses and can steer requests to weaker models Can attackers manipulate which model handles a request?. None of these is a member agent, but none is a plain outsider sending prompts either. That gap is what a position axis is meant to fill. The framing is my reading. The retrieved summaries don't say these notes were mapped onto A-I-R.

A-I-R does more than distinguish insiders from outsiders. It turns 'who is the attacker, and where do they sit?' into a question every multi-agent attack has to answer. To see exactly which positions it defines, and whether insider is one of them, you would need the SoK paper itself. The corpus only tells you the axis exists.