Does multi-agent architecture make systems easier to attack?
When the same task runs on multiple agents instead of one, does the added complexity create new vulnerabilities? This matters because it would mean multi-agent design carries a built-in security cost.
The paper's discussion opens with a heading, "Architectural Penalty of MAS," and one comparison to back it: "In Vault Mirage, GPT-5.4 SAS largely resists compromise (11% ASR) unlike in MAS (69% ASR + 6% partial leak)." The excerpt uses ASR without expanding it; attack success rate is the standard reading. What makes the number carry weight is the design around it. The abstract says the authors "keep the user task, tool surface, and browser substrate fixed" and change only whether the work is done by one agent or split across several (see How does agent architecture affect web security vulnerabilities?). If nothing else moved, the gap belongs to the architecture, not to the task or the model. That is the sense of "penalty": the same job, done by a team, is easier to compromise. Does a multi-agent setting automatically signal a security effect? reads this as the amplify case, because the fixed design supplies the single-agent baseline that case needs.
This matters because the vault has been treating multi-agent security as a list of attacks on MAS, not as a cost of choosing MAS. Can task decomposition hide harmful intent across agents? argued that the attack surface is "a price of the architecture, not a bug in a particular system," and flagged that as a vault inference with no single-agent comparison behind it. This paper is a measured instance, for a different attack (an external, web-only adversary against a browsing agent), in one scenario.
The authors' own hedge is in the same sentence family: "attack success is model-dependent in many cases, MAS does introduce structural vulnerabilities." So the claim is that a structural component exists, not that MAS always loses. A single 11 to 69 point gap is also one model in one scenario, which is why Does the multi-agent penalty hold across different models? stays open. The strongest objection is that the multi-agent system may simply expose more places to inject; the places are enumerable for one pipeline shape in Do internal agent hops in pipelines need security monitoring?, though that inventory is for a planner-worker-verifier-synthesizer pipeline and the excerpt does not say how this web system is wired. It would still be an architectural cost, but a different mechanism than the one the paper offers for prompt hardening in Why does prompt hardening work for single agents but not multi-agent systems?.
What the excerpt does not give. No count of agents or their roles, no description of what Vault Mirage asks the agents to do beyond the fact that it can produce a leak, no run counts or intervals, no statement of which condition (baseline, prompt-hardened or reasoning-enabled) the 11 and 69 figures come from, and no reasoning-enabled or Telephone Loop results.
Inquiring lines that read this note 4
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Do multi-agent systems create greater security risks than single-agent ones?- What attacks are unique to multi-agent systems compared to single agents?
- What baseline would prove multi-agent systems are actually less safe?
- When do multi-agent architectures create more attack surface than single-agent systems?
- Why do single-agent and multi-agent systems show different defense effectiveness?
Related concepts in this collection 7
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can task decomposition hide harmful intent across agents?
Explores whether splitting a harmful objective into specialized subtasks allows malicious intent to evade detection at each individual step, since no single agent sees the full malicious picture.
extends: that note's cost-of-decomposition reading was a vault inference; this is a measured single-versus-multi gap for an external-adversary attack
-
When do multi-agent systems actually outperform single agents?
As individual LLMs grow more capable, does the advantage of splitting work across multiple agents still hold? This explores when coordination overhead makes MAS counterproductive.
the benefit side of the same architectural choice; this adds a security cost to that ledger
-
How do adversarial traps target different layers of AI agents?
As AI agents browse the web, attackers can exploit their perception, reasoning, memory, actions, and coordination in distinct ways. Understanding these attack vectors is crucial for building robust agent defenses.
the taxonomy of what web agents face; this compares the same agent in two architectures
-
Where do safety wins come from in multi-agent systems?
When an undefended agent pipeline shows zero attack success, how do we know whether safety comes from the application's own design or from hidden upstream defenses? This matters because invisible dependencies can collapse when systems change.
a reason to ask which backend and filter sat behind the 11 and 69 figures
-
Which attack and defense numbers came from filtered backends?
Research figures on multi-agent attacks and defenses may have been measured behind provider filters that silently shaped the results. Understanding which numbers had this filter dependency is critical for interpreting their real-world strength.
the audit that would record the backend and filter status for each arm of this comparison
-
Does a multi-agent setting automatically signal a security effect?
Explores whether observing a failure in multi-agent systems proves the failure is genuinely multi-agent in nature. The distinction matters for correctly interpreting security research and avoiding false attributions.
reads this gap as the amplify case; the fixed design is what supplies the baseline
-
Do internal agent hops in pipelines need security monitoring?
Multi-agent systems route data between planner, worker, verifier, and synthesizer components. Current defenses only guard user input at the entry point, leaving inter-agent channels unmonitored—but is this a real vulnerability or does downstream safety suffice?
the enumerable places a multi-agent system could expose to injection, for one pipeline shape, if the objection above holds
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- Single-Agent LLMs Outperform Multi-Agent Systems on Multi-Hop Reasoning Under Equal Thinking Token Budgets
- How we built our multi-agent research system
- Towards a Science of Scaling Agent Systems
- LLMs Corrupt Your Documents When You Delegate
Original note title
the Architectural Penalty of MAS — in Vault Mirage the single-agent system largely resists at 11 percent attack success while the multi-agent system reaches 69 percent plus 6 percent partial leak