Agent Communication Poisoning
- Inter-Agent Communication
Attackers manipulate inter-agent communication channels to inject false information, misdirect decisions, or corrupt shared knowledge across a multi-agent system, extending static data poisoning to transient, in-flight coordination traffic.
What it is
Agent communication poisoning occurs when attackers manipulate the channels agents use to coordinate — injecting false information, misdirecting decisions, or corrupting the shared knowledge a multi-agent system reasons from. Unlike an attack against a single, isolated model, this threat exploits the complexity of distributed collaboration itself: a message one agent trusts because it came from a peer can carry cascading misinformation into every agent that consumes it downstream, turning a single injection point into a systemic failure.
The threat extends both Data and Model Poisoning and Vector and Embedding Weaknesses past their usual static, at-rest target: where those describe corrupting training data or a persisted embedding store, agent communication poisoning targets transient, in-flight coordination traffic that exists only for the duration of a message exchange, which is exactly what makes it easy to miss with defenses built to scan stored content.
Kinds
- Stealthy degradation
- An attacker strategically plants false data into the multi-agent network a small amount at a time, slowly corrupting collective reasoning without ever producing a single message anomalous enough to trigger a review.
- Rapid misinformation cascade
- An attacker floods the network with false data in a short window, spreading false knowledge across agents faster than any consensus or validation mechanism can catch up.
Attack scenarios
An attacker plants a subtly false consensus message on the agent-to-agent channel of a distributed planning system, steadily corrupting the shared plan every participating agent reasons from.
Collaborative decision manipulation
An attacker injects misleading information into agent communications, gradually influencing decision-making and steering the multi-agent system toward misaligned objectives.
Trust network exploitation
By forging false consensus messages and exploiting authentication weaknesses, an attacker manipulates inter-agent validation mechanisms, gaining unauthorized access and provoking deceptive behavior.
Communication channel manipulation
An attacker exploits vulnerabilities in the inter-agent communication protocol itself, injecting artificial barriers, intercepting or modifying messages, and introducing transmission delays to degrade system efficiency.
Consensus mechanism exploitation
By subtly perturbing agents' decision-making logic, an attacker introduces artificial disagreement among them, progressively eroding collective problem-solving and making the system unreliable.
Documented incidents
Public cases, each checked against its primary source. A research demonstration shows the attack works against real systems; it is not a reported breach.
Agent-in-the-Middle attacks on agent messages
By intercepting and rewriting only the messages passed between agents, researchers compromised multi-agent systems built on AutoGen and Camel and degraded MetaGPT and ChatDev, with success rates above 40% in every setup and above 70% in most.
He et al., “Red-Teaming LLM Multi-Agent Systems via Communication Attacks” (arXiv:2502.14847)Morris II: a self-replicating prompt worm
A prompt that copies itself spread between GenAI-powered email assistants: each infected assistant leaked data or sent spam and forwarded the prompt to the next assistant through ordinary email.
Cohen, Bitton, Nassi, “Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications” (arXiv:2403.02817)Mitigations
- Authenticate and encrypt every message
- Require message authentication and encryption for all inter-agent communication, including messages that propagate within the system, so a forged or intercepted message can't pass as a trusted peer's output — the discipline behind the A2A (Agent-to-Agent) Protocol.
- Require consensus before high-risk action
- Use agent trust scoring and consensus verification before executing a high-risk operation, requiring multiple independent agent approvals for workflow-critical decisions rather than trusting a single message.
- Segment who can talk to whom
- Limit agent-to-agent communication to predefined functional roles and apply task segmentation, so a poisoned channel can't propagate past the boundary an attacker would need to escalate across.
- Monitor and audit inter-agent traffic
- The Audit Trail logs agent-to-agent communication and flags requests outside normal behavior, and a Controller tracks trust-score deviations and decision-approval discrepancies so a compromised channel is forensically visible.