Theme of inquiry
What security vulnerabilities enable agent misbehavior in multi-agent systems?
A question within its area, explored through 5 lines of inquiry below — each a family of specific questions the research asks.
24 specific questions
- How does the execution layer constrain agent performance in tool use?
- Should production agents execute one tool or multiple tools per invocation?
- How do agents discover and select which tools to invoke?
- Can deterministic function calls prevent agent failures better than protocol-mediated tool access?
- Why do production agents depend more on their surrounding pipeline than the model?
- Can open agent workflows be modeled as finite event lifecycles?
- Should agents use APIs or GUI interaction for efficiency?
38 specific questions
- Are durable shared code artifacts better than per-task harness patches?
- How do agents decide which created code deserves long-term persistence?
- How should agents decide which created code is worth persisting?
- How do agents decide which created code should persist versus disappear?
- Can skill libraries prevent redundant narrow artifacts from proliferating?
- Can skill validation through testing prevent unreliable programs from accumulating?
- How should harness infrastructure validate code that agents generate themselves?
49 specific questions
- Why does infrastructure-side evidence matter more than agent-reported traces?
- Can execution traces reveal unsupported claims in AI agent behavior?
- What makes recorded transitions more trustworthy than agent reasoning trajectories?
- Can infrastructure evidence ground benchmark claims better than terminal scores alone?
- What process records would independently verify that agents performed required steps?
- How should verifiable process memory anchor safety-critical action logs?
- Can agents themselves read and rely on tamper-evident process records?
53 specific questions
- How does workflow position amplify malicious signals in multi-agent systems?
- Why do downstream agents relay signals they did not originate?
- Can ordinary peer messages inject hidden bias through multi-agent networks?
- How much does misaligned communication spread between agents in multi-agent commerce?
- Can ordinary agent-to-agent messages carry hidden behavioral signals?
- How does prompt injection differ from subliminal message propagation in multi-agent networks?
- Do ordinary agent-to-agent messages carry behavioral bias without special access?
46 specific questions
- Can safe individual AI agents fail when deployed together?
- What makes agent-to-agent messages in multi-agent systems vulnerable to exploitation?
- How does task division in multi-agent design affect security outcomes?
- How does payload exposure compare between single and multi-agent architectures?
- When do multi-agent architectures create more attack surface than single-agent systems?
- How does a single compromised agent degrade performance across entire multi-agent pipelines?
- What baseline would prove multi-agent systems are actually less safe?