Agent securityAdvancedLesson 175 min read

Attacks that spread between agents

When agents talk to each other, a single poisoned message can travel through a system that has no idea it is under attack.

🧪 Lab · 20 min📝 Lesson test
Lesson in motion

In 60 seconds

Attacks that spread between agents

When agents talk to each other, a single poisoned message can travel through a system that has no idea it is under attack.

1/6
In simple words
One kid in the group project reads a fake note and tells everyone else. Now the whole group believes it, and nobody remembers where it came from.
In a multi-agent system, the output of one agent becomes the input of another. If agent A was injected, agent B receives the attacker's instructions wearing agent A's uniform — arriving over an internal channel, labelled "internal research summary", carrying all the trust that label implies.
Poisoned pageResearcher"findings"PlannerEmailer · has sendthe planner never saw the internet — it just trusted a teammatetaint travels; trust labels do not check it
Three hops from a web page to an outbound email, with no component doing anything it was not designed to do.

Failure modes specific to teams of agents

NameWhat happensWhy it is hard to spot
Injection relayA tainted message is forwarded inward as trustedEach hop looks like normal internal traffic
Permission poolingIndividually safe agents combine into an unsafe chainNo single agent looks over-privileged
Consensus theatreA critic agent approves because it read the same poisoned textIt creates a paper trail of "review" that means nothing
Runaway loopsAgents call each other until budget or rate limits blowLooks like activity, not failure
Blame diffusionThe bad action is the last step of a long, reasonable chainEvery individual step passes review

Design rules that hold up

  1. 1

    Taint labels travel with data

    Every message carries where its content originally came from. Tainted content can never trigger a write action without a human.
  2. 2

    Structured messages only

    Agents exchange typed fields, not free prose. A JSON object with three named string fields is a much smaller doorway than a paragraph.
  3. 3

    One internet-facing agent

    Exactly one component touches untrusted content, and that component has zero tools beyond reading. Everything else lives behind it.
  4. 4

    Look at the union of powers

    Draw the whole graph and ask what the most damaging path through it is. Design against that path.
  5. 5

    Hard budgets everywhere

    Steps, time, spend, per-agent and system-wide. Loops are guaranteed eventually; make them cheap.
  6. 6

    One trace, one ID

    Every hop shares a correlation ID so you can reconstruct the whole chain after the fact.
Danger
Never treat a critic or verifier agent as a security control. It is reading the same attacker-authored text as the agent it is checking, and the same sentence that fooled one will usually fool the other.
Do this
If you want a real check, make it a check that does not read the untrusted text: a plain-code rule on the proposed action. "Refunds over ₹5,000 require a human." Code cannot be persuaded.

Watch and read more

Multi-agent security risksYouTube searchAgent-to-agent injection researchYouTube search

Lab

Taint tracking across a multi-agent graph, measured in hops.

~20 min

The problem

Take the three-agent system from Lab 6 and instrument it: every message carries a taint label naming its ultimate origin. Inject at every entry point and measure how many hops pass before something irreversible happens. Then enforce: tainted data may inform, never authorise.
Starter codepython
from dataclasses import dataclass

@dataclass
class Message:
    content: str
    taint: str | None          # None = trusted; else the origin
    hops: int = 0

    def forward(self, content):
        return Message(content, self.taint, self.hops + 1)

def can_authorise(msg: Message) -> bool:
    return msg.taint is None      # tainted data never authorises a write

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1The Planner summarises the Reader's output. The summary contains no attacker words. Is it still tainted?Reveal
Yes. Taint tracks influence, not substrings. A summary derived from attacker-controlled input is attacker-influenced — its content, emphasis and conclusions were shaped by text you do not trust. Clearing taint on summarisation is exactly how laundering works, and it is a tempting optimisation because the output looks clean.
Q2Your system needs tainted research to trigger a purchase. Design it so that is safe, or prove it cannot be.Reveal
It can be, by routing authority around the taint rather than through it. The tainted path may only produce a proposal as a typed object — vendor from a pre-approved list, amount under a cap, SKU that must exist in your catalogue. Every field is validated against trusted data before a human sees a rendered summary built from the arguments, not from model prose. The tainted content never authorises; it only fills constrained slots that trusted code checks. If any field cannot be constrained against a trusted source, that field needs a human, full stop.

Please sign in to continue.

Questions people ask

Should agents talk in natural language at all?

It is convenient and it widens the doorway. Structured messages between agents are meaningfully safer. Save natural language for the boundary with humans, where it earns its keep.

How do I test a multi-agent system?

Inject at every entry point and see how far the taint travels. Your test is not "did an agent get fooled" — it is "how many hops before something irreversible happens." That number is the thing to drive down.

Is one big agent safer than five small ones?

Often, yes, if the small ones collectively hold more power. One agent with three tools beats five agents holding twelve tools between them. Count the union, not the parts.

What about agents from different companies talking?

Then you have crossed a trust boundary with someone else's security posture on the far side. Treat every inbound message as fully untrusted content, exactly like an email from a stranger — because that is precisely what it is.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in with your phone number to take the test and save your progress