Some attacks only work because AI agents talk to each other — which ones are truly new, and which are old tricks in new clothes?

This explores which attacks only exist, or only work, because several AI agents message, delegate to, and share state with each other, as opposed to ordinary attacks on a lone agent. The corpus first says to be strict about what counts. Putting a failure inside a multi-agent setting doesn't make it a multi-agent attack. Interaction can leave a failure unchanged, which is a single-agent problem in a new setting. It can amplify a failure, create one through composition, or define an entirely new property. Only the last three are genuinely multi-agent effects Does a multi-agent setting automatically signal a security effect?. The paths are also specific. Failures cross agent boundaries through messages that carry influence, shared state that preserves it, aggregation that combines possibly corrupted outputs, and delegation that hands over authority How do failures cross boundaries between multiple agents?.

The clearest examples are attacks that have no single-agent counterpart. The Telephone Loop abuses delegation so that agents pass a task around in a circle. It needs several agents to exist at all, and it isn't an old attack applied to a team Can agents be tricked into delegating work in circles?. Bias can also spread. One compromised agent can pass persistent behavioral corruption through six downstream agents using only normal-looking messages, and paraphrasing defenses miss it because the bias carries no explicit semantic content Can one compromised agent corrupt an entire multi-agent network?. A harmful goal can also be split into pieces that each look harmless. Every agent sees a benign subtask, so a classifier checking one message at a time has nothing to flag Why do single-message classifiers miss cross-agent harms?.

The attack surface can also sit in the team's structure. In planner-executor systems, a crafted prompt can bias how the workflow is formed. This happens upstream of the workflow inspection defenses, and it raised malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?. Architecture may also raise the baseline risk. In one test with the same task, tools, and model, a single agent resisted attack 89% of the time, while its multi-agent version was breached 69% of the time, with another 6% partial leaks Does multi-agent architecture make systems easier to attack?. That comes from one model and one scenario, so nobody knows yet how far the penalty generalizes Does the multi-agent penalty hold across different models?. Performance research points the same way. It names path-level error propagation as a structural weakness of multi-agent designs, and the same channel that spreads mistakes can spread attacks When do multi-agent systems actually outperform single agents?.

The common thread is that the attack lives in the relationships between agents, not in any single message. That is why defenses move from filtering outputs to controlling what agents can reach. A model-level filter judges one output at one moment and can't contain an agent with memory, tools, and environmental reach Can a model-level filter truly contain an agent with environment access?. The counter-swarm doctrine takes the opposite stance. It preserves relationships across executions, limits the shared resources agents can touch, and ties responses to persistent state instead of closed channels How can operators stop coordinated agent intrusions now?.