Systemic Risks in Multi-Agent LLM Systems (SoK Survey)
First seen Sep 2, 2026 · Updated Sep 2, 2026
This is an academic systematization-of-knowledge (SoK) paper analyzing 197 prior works on multi-agent LLM system security, not a novel exploit or active threat. It proposes an organizing framework (A-I-R: adversary position, interaction interface, resulting risk) to unify understanding of how attacks propagate across agent boundaries in MAS. Severity is low because this is a research taxonomy/survey with no new attack disclosed, no PoC, and no affected product identified.
Technical Analysis
The paper synthesizes existing literature on multi-agent LLM system (MAS) vulnerabilities rather than disclosing a new attack. It categorizes risks along three axes: adversary position (where an attacker sits relative to the system), interaction interface (how agents communicate: six identified interfaces), and resulting system-level risk (seven categories), plus eight recurring attack paths seen across prior work. Its central technical contribution is highlighting that single-agent or local security checks fail to capture emergent, execution-level failures that only manifest when state, authority, or decisions cross principal boundaries between agents. The paper also audits 44 benchmarks, finding most fail to isolate genuine multi-agent interaction effects from confounded single-agent behavior, and proposes a five-part defense contract (path target, observation, intervention, trust boundary, recovery) as a checklist for evaluating MAS defenses.
Detection Signatures
- N/A - this is a survey/taxonomy paper, not an exploit; no indicators of compromise apply.
- Defenders should instead look for: cross-agent authority escalation in logs, unexplained state/decision propagation across agent trust boundaries, and benchmark evaluations that fail to isolate multi-agent interaction effects from single-agent baseline behavior.
Remediation Steps
- 1
Adopt execution-level tracing for MAS
Instrument multi-agent deployments to trace information, state, and authority flow end-to-end across agent and tool boundaries rather than relying on local, per-agent checks.
- 2
Apply the five-part defense contract
Evaluate existing and planned defenses against path target, observation, intervention, trust boundary, and recovery criteria to identify gaps, especially around path closure and recovery.
- 3
Use counterfactual benchmarking
When evaluating MAS security tooling, test against benchmarks that isolate genuine multi-agent interaction effects from confounded single-agent behavior, per the paper's audit findings.
- 4
Map internal MAS architecture to A-I-R framework
Use the adversary-position / interaction-interface / risk framework to systematically audit internal multi-agent deployments for the eight recurring attack paths identified in the literature.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.