Security — the attack surface of a multi-agent system.
How multi-agent systems get attacked, and which defenses close each gap. Two OWASP catalogs — the LLM Top 10 and the Agentic Threats — mapped to the guardrails, least-privilege, and human gates this project already documents.
- 5
- Attack surfaces
- 27
- Threats
- 2
- OWASP catalogs
- 10
- ASI patterns
Six ways a MAS amplifies risk a single call never carries.
Adding agents does not add attack surface linearly. Several risks below exist only once agents coordinate, and each raises the cost of one compromise well past anything a lone LLM call could expose.
- 01
Blast radius
A single LLM call fails in isolation. A compromised agent can pass its corrupted state to every agent that trusts its output without re-verifying it, so one exploited hand-off cascades into a system-wide failure.
- 02
Agent collusion
Two or more compromised or subtly misaligned agents can coordinate — through shared memory, negotiated protocol messages, or repeated interaction — to manipulate a decision in a way no individual agent's output would flag as anomalous.
- 03
Identity sprawl
One agent needs one identity. A dozen agents, each holding its own tool credentials and delegated permissions, turn identity and access management into a combinatorial problem — every added identity is one more credential to spoof or over-provision.
- 04
Coordination failures in dynamic environments
The routing, voting, or consensus logic that lets agents adapt to changing conditions is rarely tested against adversarial conditions, and can break down — or be driven into breaking down — once an adversary controls part of that variance.
- 05
Decision-lineage & auditability gaps
No single agent holds the full reasoning trace behind a multi-agent decision, so reconstructing why the system acted means stitching together partial, differently-shaped traces from every agent that touched it.
- 06
Man-in-the-middle on inter-agent channels
The messages agents exchange — hand-offs, blackboard writes, negotiated votes — travel over a channel a single-LLM application never has, and an attacker who intercepts or alters it changes what one agent believes another said.
All 27 threats, located on the architecture.
Before the index lists them, the threat map shows where each threat enters — from untrusted input through the agent runtime to the triggered action. Hover a threat to see where it lands and which further surfaces it touches.
The threats and defenses on this page map directly to the OWASP GenAI Security Project's published catalogues. Read the source documents:
27 threats, ordered by attack surface.
Rather than two separate catalogs, every entry of the OWASP LLM Top 10 and the Agentic Threats (T1–T17) is filed under the surface it enters. Threats spanning several surfaces appear more than once — each row keeps its origin tag (LLM / Agentic) and its other surfaces.
Input / Prompt
6 threatsEverything the system reads — user prompts and untrusted content an agent ingests — where injection enters.
- LLM01Prompt InjectionCrafted input overrides the model's instructions, directly or via poisoned content the agent reads (indirect injection).
- LLM07System Prompt LeakageAn attacker extracts the system prompt — operational instructions, tool definitions, or embedded secrets — through crafted queries, exposing implementation details that should stay private.
- LLM10Unbounded ConsumptionThe application allows excessive or uncontrolled resource usage — inference calls, token volume, tool invocations — enabling denial-of-service, runaway cost, or model-extraction abuse.
- T4Resource OverloadAttackers deliberately exhaust an agent's computational, memory, or external-service capacity — including self-triggered task spawning and multi-agent coordination — to degrade performance or cause failure.
- T6Intent Breaking & Goal ManipulationAttackers exploit the lack of separation between data and instructions to alter an agent's planning, reasoning, or self-evaluation, overriding its intended objective — an extension of prompt injection into long-horizon goal state.
- T14Human Attacks on Multi-Agent SystemsAdversaries exploit inter-agent delegation, trust relationships, and workflow dependencies — rather than attacking a single agent directly — to escalate privilege or manipulate AI-driven operations across the system.
Memory / State
5 threatsPersistent state and retrieved context, where poisoned memory biases every later decision.
- LLM02Sensitive Information DisclosureThe model inadvertently exposes confidential data — training data, retrieved documents, or another user's stored context — in its response.
- LLM04Data and Model PoisoningTraining, fine-tuning, or embedding data is corrupted — deliberately or via a compromised source — so the model's outputs or a retrieval index become unreliable in a way an attacker controls.
- LLM08Vector and Embedding WeaknessesThe vector stores and embedding pipelines behind retrieval are exploited — poisoned embeddings, cross-tenant leakage in a shared index, or adversarial inputs that manipulate similarity search — to compromise a RAG pipeline.
- T1Memory PoisoningAttackers exploit an agent's reliance on short- or long-term memory to inject malicious or false data, corrupting future decisions, bypassing security checks, or escalating privilege via memory recall.
- T17Supply Chain CompromiseA compromised component — a model, adapter, library, tool, MCP server, prompt template, or build environment — is drawn into the agent, letting an attacker manipulate its actions, exfiltrate data, or run arbitrary code without ever interacting with the agent directly.
Tools & External Data
11 threatsThe tools and external data an agent calls, where misuse and poisoned results turn reach into risk.
- LLM03Supply ChainA compromised component — a poisoned base model, a malicious fine-tune, a tainted plugin or MCP server, or a compromised dataset — enters the system before or during deployment.
- LLM04Data and Model PoisoningTraining, fine-tuning, or embedding data is corrupted — deliberately or via a compromised source — so the model's outputs or a retrieval index become unreliable in a way an attacker controls.
- LLM06Excessive AgencyAn agent is granted more autonomous capability — tools, permissions, or unsupervised action — than its task requires, so a model error or manipulation can act, not merely answer wrong.
- LLM08Vector and Embedding WeaknessesThe vector stores and embedding pipelines behind retrieval are exploited — poisoned embeddings, cross-tenant leakage in a shared index, or adversarial inputs that manipulate similarity search — to compromise a RAG pipeline.
- LLM10Unbounded ConsumptionThe application allows excessive or uncontrolled resource usage — inference calls, token volume, tool invocations — enabling denial-of-service, runaway cost, or model-extraction abuse.
- T2Tool MisuseAttackers manipulate an agent into abusing its already-granted tools through deceptive prompts, chaining otherwise-legitimate tool calls into an unauthorized sequence while staying within its nominal permissions.
- T3Privilege CompromiseAttackers exploit mismanaged roles, overly broad permissions, or dynamic and inherited privilege to escalate an agent's access beyond its intended scope.
- T4Resource OverloadAttackers deliberately exhaust an agent's computational, memory, or external-service capacity — including self-triggered task spawning and multi-agent coordination — to degrade performance or cause failure.
- T11Unexpected RCE and Code AttacksAttackers exploit an agent's code-generation or code-execution capability to run unsafe or malicious code, escalate privilege, or compromise the host system directly.
- T16Insecure Inter-Agent Protocol AbuseAttackers exploit weaknesses in the coordination protocols agents speak — chiefly MCP and A2A — to bypass consent checks, hijack a protocol transition, or corrupt shared context, turning the connective tissue of a multi-agent system into an actuation path.
- T17Supply Chain CompromiseA compromised component — a model, adapter, library, tool, MCP server, prompt template, or build environment — is drawn into the agent, letting an attacker manipulate its actions, exfiltrate data, or run arbitrary code without ever interacting with the agent directly.
Inter-Agent Communication
9 threatsMessages between agents, where a poisoned or spoofed peer propagates compromise across the system.
- T3Privilege CompromiseAttackers exploit mismanaged roles, overly broad permissions, or dynamic and inherited privilege to escalate an agent's access beyond its intended scope.
- T5Cascading Hallucination AttacksAn agent's tendency to generate plausible-but-false content is exploited so the fabrication propagates and amplifies through memory, self-reflection, or inter-agent communication rather than staying contained to one response.
- T6Intent Breaking & Goal ManipulationAttackers exploit the lack of separation between data and instructions to alter an agent's planning, reasoning, or self-evaluation, overriding its intended objective — an extension of prompt injection into long-horizon goal state.
- T7Misaligned & Deceptive BehaviorsAn agent executes harmful, disallowed, or self-preserving actions while outwardly maintaining the appearance of compliance, exploiting the gap between stated and actual behaviour.
- T9Identity Spoofing & ImpersonationAttackers exploit weak or missing authentication to impersonate an agent, user, or service, gaining unauthorized access or action while appearing legitimate.
- T12Agent Communication PoisoningAttackers manipulate inter-agent communication channels to inject false information, misdirect decisions, or corrupt shared knowledge across a multi-agent system, extending static data poisoning to transient, in-flight coordination traffic.
- T13Rogue Agents in Multi-Agent SystemsA malicious or compromised agent operates outside its intended boundaries inside a multi-agent architecture, exploiting inter-agent trust to manipulate decisions, corrupt data, or execute unauthorized actions undetected.
- T14Human Attacks on Multi-Agent SystemsAdversaries exploit inter-agent delegation, trust relationships, and workflow dependencies — rather than attacking a single agent directly — to escalate privilege or manipulate AI-driven operations across the system.
- T16Insecure Inter-Agent Protocol AbuseAttackers exploit weaknesses in the coordination protocols agents speak — chiefly MCP and A2A — to bypass consent checks, hijack a protocol transition, or corrupt shared context, turning the connective tissue of a multi-agent system into an actuation path.
Output / Actuation
11 threatsWhat the system emits or actuates, where unvalidated output and excessive agency cause real-world harm.
- LLM02Sensitive Information DisclosureThe model inadvertently exposes confidential data — training data, retrieved documents, or another user's stored context — in its response.
- LLM05Improper Output HandlingModel-generated content is passed downstream — into a shell, a database query, a browser, another agent — without adequate validation or sanitisation, so the model's text becomes an execution path.
- LLM06Excessive AgencyAn agent is granted more autonomous capability — tools, permissions, or unsupervised action — than its task requires, so a model error or manipulation can act, not merely answer wrong.
- LLM07System Prompt LeakageAn attacker extracts the system prompt — operational instructions, tool definitions, or embedded secrets — through crafted queries, exposing implementation details that should stay private.
- LLM09MisinformationThe model produces false or misleading content that reads as confident and authoritative, which users or downstream systems trust without independent verification.
- T5Cascading Hallucination AttacksAn agent's tendency to generate plausible-but-false content is exploited so the fabrication propagates and amplifies through memory, self-reflection, or inter-agent communication rather than staying contained to one response.
- T7Misaligned & Deceptive BehaviorsAn agent executes harmful, disallowed, or self-preserving actions while outwardly maintaining the appearance of compliance, exploiting the gap between stated and actual behaviour.
- T8Repudiation & UntraceabilityAgents act autonomously without sufficient logging or forensic traceability, so decisions and actions cannot be attributed or reconstructed after the fact.
- T10Overwhelming Human-in-the-LoopAttackers exploit human oversight dependencies by flooding reviewers with excessive intervention requests, inducing decision fatigue and rushed, less-scrutinised approvals.
- T11Unexpected RCE and Code AttacksAttackers exploit an agent's code-generation or code-execution capability to run unsafe or malicious code, escalate privilege, or compromise the host system directly.
- T15Human ManipulationAttackers exploit the trust a human user places in an agent's outputs to influence the human's decisions or actions, without the human realizing they are being misled.
Agentic AI Patterns
The OWASP Agentic Security Initiative's shared vocabulary for threat-modeling conversations. Each maps to a pattern this project already covers in depth.
Reflective Agent
Agents that iteratively evaluate and critique their own outputs to enhance performance.
AI code generators that review and debug their own outputs, like Codex with self-evaluation.
Maps to: Reflexion →Task-Oriented Agent
Agents designed to handle specific tasks with clear objectives.
Automated customer-service agents for appointment scheduling or returns processing.
Maps to: ReAct →Hierarchical Agent
Agents organized in a hierarchy, managing multi-step workflows or distributed control systems.
Project-management systems where higher-level agents oversee task delegation.
Maps to: Hierarchical Supervisor →Coordinating Agent
Agents facilitate collaboration, coordination, and tracking, ensuring efficient execution.
A coordinator assigns subtasks to specialists in an AI-powered DevOps workflow: one plans deployments, another monitors performance, a third handles rollbacks.
Maps to: Orchestrator-Workers →Distributed Agent Ecosystem
Agents interact within a decentralized ecosystem, often in IoT or marketplaces.
Autonomous IoT agents managing smart-home devices, or a marketplace with buyer and seller agents.
Maps to: Swarm / Contract-Net →Human-in-the-Loop Collaboration
Agents operate semi-autonomously with human oversight.
AI-assisted medical-diagnosis tools that recommend but let doctors make the final decision.
Maps to: HITL Gate →Self-Learning and Adaptive Agents
Agents adapt through continuous learning from interactions and feedback.
Co-pilots that adapt to user interactions over time, learning from feedback.
Maps to: Skill-Build / Reflector →RAG-Based Agent
Agents use Retrieval-Augmented Generation to draw on external knowledge sources dynamically.
Agents performing real-time web browsing for research assistance.
Maps to: Agentic RAG →Planning Agent
Agents autonomously devise and execute multi-step plans to achieve complex objectives.
Task-management systems organizing and prioritizing tasks by user goals.
Maps to: Plan-and-Execute →Context-Aware Agent
Agents dynamically adjust their behavior and decision-making based on the context in which they operate.
Smart-home systems adjusting settings based on user preferences.
Maps to: Virtual Context Management →
Security