The proposed SUA-Arena, which implements 6 attack strategies and contains 188 test cases, finds that all of them are vulnerable to show-up attacks and shows that multi-agent systems need explicit mechanisms for enforcing authority boundaries.
Abstract
Multi-agent systems are increasingly deployed to coordinate multiple large language model (LLM) agents. However, this also creates new attack surfaces: malicious agents may have chances to exploit the coordination. In this paper, we propose and study the \textit{show-up attack}, in which a malicious subagent manipulates the supervisor into involving it in tasks beyond its assigned scope. To evaluate this risk, we propose SUA-Arena, which implements 6 attack strategies and contains 188 test cases. Then, we evaluate 6 frontier LLMs and find that all of them are vulnerable to show-up attacks. For example, GPT-5.6-Sol as a supervisor suffers an ASR of up to 0.93. Mitigation strategies such as prompting and restricted communication fail to reduce the risk consistently. These results show that multi-agent systems need explicit mechanisms for enforcing authority boundaries.
This work demonstrates distributed attacks, in which different agents carry out separate attack fragments, and how their covertness evades frontier monitors when reading their trajectories individually, and provides a foundation for preventing locally benign agent actions from accumulating into system-level loss of con...
John Kitaoka, T. Pham, Carlos Giudice et al.· 0 citations
LLM-based multi-agent systems (MAS) engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes defenses into five p...
Shaswata Mitra, Raj Patel, Subash Neupane et al.· 0 citations
This work emulates a software-engineering workflow in which a planner represents a company hiring an external developer and reads the nondisclosure rule as banning plaintext, not character codes or riddles, and shows that benign agents can cross the same boundaries without adversarial incentives.
Deema Alnuhait, Geng-Yu Wang, Muhammad Khalifa et al.· 1 citation
Agent-to-agent protocols allow LLM agents to discover peers, exchange results, and coordinate tool use. A locally successful protocol attack, however, may be rejected by a later agent or propagated into a consequential task decision. Measuring local exploitability alone leaves this difference unresolved and provides li...
Xiu-Ming Liu, Le Gai, Zhi-Yuan Chang et al.· 0 citations
Multi-agent LLM systems are increasingly deployed for complex, long-horizon tasks or emerge as a natural consequence of agents interacting in the wild. Yet they give rise to significant safety and security risks: the flexible protocols that enable task generalization also expose novel threats, from cascading prompt inj...
Ben Hagag, William L. Anderson, S. Chakraborty et al.· 1 citation
Large language models (LLMs) have progressively evolved into the core of autonomous agents. Building on this progress, LLM-based multi-agent systems (MAS) coordinate multiple agents into a synergistic team to accomplish complex tasks that exceed the capabilities of individual agents. The effectiveness of such systems d...
Qi-Zhi Chu, Ze-Kai Yu, Si-Jie Wen et al.· 0 citations
Research Manager Mike Walker reflects on a career spanning hacker culture, cybersecurity, and AI, sharing lessons about trust, teamwork, leadership, and why solving difficult problems requires curiosity, judgment, agility—and an understanding of the rules. The post Learn the rules: The hacker mindset appeared first on Microsoft Research.
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
