Securing Multi-Agent Teams and the Protocol Layer
A single generative model has one trust boundary. A team of interacting agents introduces network effects, converting an isolated failure into a distributed attack surface.
By Piotr Zenon Żabrowski · Published · Updated
The orchestrator and the attack surface
Agentic systems separate tasks by role. An orchestrator handles user input and plans the objective, assigning specific tasks to specialized agents acting as researchers, executors, or memory managers. These subordinate agents connect to external applications, search tools, and databases. While this separation limits what any single prompt must process, it increases the attack surface. Interconnecting multiple agents and services means a vulnerability in one specialized component can be exploited to compromise the entire system ([CNIL / Conseil de l'IA et du Numerique: Agent-based AI and personal data protection](https://www.cnil.fr/sites/default/files/2026-07/ia-cianum-cnil.pdf)).
Role-based error cascades
The way an architecture divides responsibilities dictates how security failures propagate. A corrupted input or indirect prompt injection affects specialized roles differently:
- Centralized planning: An orchestrator breaking down complex tasks represents a single point of failure. A manipulated planner can distribute compromised instructions to all downstream executors, multiplying the attack impact.
- Chain execution: When a researcher agent's findings feed directly into an executor agent, a poisoned search result cascades into an unauthorized action without secondary verification.
- Consensus manipulation: In setups where multiple critic agents review work to ensure quality, adversarial inputs can steer the evaluation logic. This causes the entire group to confidently align on a fabricated output or approve a malicious tool call.
The protocol layer as a target
Agents do not interact in a vacuum. They exchange state and commands with tools and each other using standardized protocols, such as Anthropic's Model Context Protocol ([Model Context Protocol documentation](https://modelcontextprotocol.io/docs/getting-started/intro)) or OpenAI's ACP. Standardization makes interoperability possible, but it also creates a uniform interface for attackers. If an adversary understands the protocol format, they can craft inputs targeting the message-passing mechanism directly. These communication channels represent new APIs that require explicit defense.
Defending the team
Controls for multi-agent architectures
- Authenticate agent-to-agent messages instead of trusting internal traffic by default.
- Isolate role access: a researcher agent fetching external web pages must not hold the credentials used by an executor agent.
- Enforce step limits on the orchestrator to prevent infinite execution loops triggered by adversarial input.
- Require a human approval step for any agent action that writes data or transmits information outside the system boundary.
Related
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
Agent blast radius
A bad model decision becomes an incident through tool calls. Agent memory determines how long and how far the damage can spread.
From Threat Modeling to a General Principle
Thoughts on threat modeling
Cloud architecture review
Design-stage review of cloud and hybrid architecture: trust boundaries, identity model, segmentation, key management and detection design.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.
Threat modeling
A practical STRIDE-based threat modeling method for cloud, application and AI systems, built to be run by engineering teams.