Summary: What the second agent adds — communication poisoning (T12), rogue agents including infectious backdoors (T13), and human exploitation of inter-agent delegation and trust (T14).
Sources: raw/Agentic/Agentic-AI-Threats-and-Mitigations-1.1.pdf
Last updated: 2026-07-29
These three activate at step 6 of the decision path: does the system rely on multiple interacting agents? Everything else in the taxonomy can apply to a single agent. OWASP’s framing is that multi-agency does not only add threats, it scales existing ones — single-agent risks “can scale through trust exploitation, inter-agent dependencies, and cascading failures, leading to systemic risks” (source: Agentic-AI-Threats-and-Mitigations-1.1.pdf, p. 20).
The recommended review order follows from that: understand single-agent risks first, then assess how they propagate.
T12 — Agent Communication Poisoning
“Agent Communication Poisoning occurs when attackers manipulate inter-agent communication channels to inject false information, misdirect decision-making, and corrupt shared knowledge within multi-agent AI systems” (p. 31).
Positioned against the Top 10 the same way T1 is: it “goes beyond the static data poisoning defined in LLM04:2025 or the embeddings poisoning in RAG covered by LLM08:2025 and targets transient and dynamic data.” The poisoned artefact is a message in flight, not a stored record — so anything scanning data at rest misses it entirely.
Five scenarios (p. 31):
- Collaborative Decision Manipulation — misleading information injected into agent communications, gradually steering the system toward misaligned objectives.
- Trust Network Exploitation — forged consensus messages plus authentication weaknesses to manipulate inter-agent validation.
- Misinformation Injection & Cascade Poisoning — either “a stealthy degradation attack that slowly corrupts reasoning” or “a rapid misinformation cascade.” Two speeds, two detection profiles.
- Communication Channel Manipulation — injecting communication barriers, intercepting or modifying messages, introducing transmission delays to degrade efficiency.
- Consensus Mechanism Exploitation — subtly perturbing decision logic to introduce artificial disagreement, “progressively eroding collective problem-solving capabilities.”
Scenario 5 attacks the defence. Multi-agent consensus is prescribed elsewhere in the document as a mitigation for T12 itself and for T1 — and here consensus is the target. Any design leaning on agent voting needs to answer this.
T13 — Rogue Agents in Multi-Agent Systems
“Malicious or compromised AI agents operate outside normal monitoring boundaries, executing unauthorized actions or exfiltrating data” (p. 18). Rogue agents “can be intentionally introduced by adversaries or arise from compromised AI components” (p. 32).
Framed as “adversarial exploitation of LLM06 Excessive Agency in Agentic AI settings; introduces persistent rogue agent risks where adversarial agents can remain embedded in workflows unnoticed.”
The distinctive concept is the infectious backdoor — named in the table entry as “one compromised agent spreads malicious logic to others.” Scenario 4 develops it: “A single compromised agent in a financial multi-agent system embeds an ‘infectious backdoor’ in its reasoning chain. As other agents consume its outputs during inter-agent coordination, the malicious logic silently propagates across the network, leading to systemic compromise of transaction approvals” (p. 32, citing arxiv.org/html/2503.09648v1).
Propagation happens through normal operation. No agent is exploited in the memory-corruption sense; each simply reads a peer’s output and incorporates it. This is the multi-agent analogue of T5, with malicious logic instead of false facts.
Other scenarios (p. 32): Malicious Workflow Injection (a rogue agent impersonating a financial approval AI to inject fraudulent transactions); Orchestration Hijacking (routing a fraudulent transaction through multiple lower-privilege agents so fragmented approvals bypass manual verification); Coordinated Agent Flooding (rogue agents generating excessive task requests to overwhelm compute).
Orchestration Hijacking deserves attention — it defeats approval thresholds by decomposition. No single agent ever sees a transaction large enough to escalate.
The document is unusually honest about the mitigation gap here: “while cryptographic attestation mechanisms for LLMs do not yet exist, agent integrity can be maintained via controlled hosting environments, regular AI red teaming, and input/output monitoring for deviations” (p. 18). There is no way to prove an agent is the agent you deployed.
T14 — Human Attacks on Multi-Agent Systems
“Adversaries exploit inter-agent delegation, trust relationships, and workflow dependencies to escalate privileges or manipulate AI-driven operations” (p. 19). By “injecting deceptive tasks, rerouting priorities, or overwhelming agents with excessive assignments,” attackers manipulate decision-making “in ways that are difficult to trace and mitigate” (p. 31).
The distinction from T13: in T13 the adversary is an agent inside the system; in T14 the adversary is a human outside it, exploiting the topology.
Four scenarios (p. 32):
- Coordinated Privilege Escalation via Multi-Agent Impersonation — compromising identity verification and access control agents so one AI falsely authenticates another.
- Agent Delegation Loop for Privilege Escalation — repeatedly escalating a request between interdependent agents until the system grants elevated access “under the assumption of prior validation.” Circular trust, mistaken for a chain of custody.
- Denial-of-Service via Agent Task Saturation — flooding with high-priority tasks so security agents cannot process real threats.
- Cross-Agent Approval Forgery — exploiting inconsistencies between agents’ authentication checks to get an identity approved that “would fail full-system validation.”
Scenarios 2 and 4 are the same underlying flaw seen twice: agents treat each other’s assertions as evidence without tracking provenance. Neither is caught by strengthening any individual agent.
Mitigations — Playbook 6
Pp. 41–42. Labelled “Step 5” in the source though the navigator places multi-agent at step 6.
Proactive
- Message authentication and encryption for all inter-agent communication, including messages propagating within the system
- Agent trust scoring to evaluate reliability of transactions
- Consensus verification before high-risk operations; multiple agent approvals for workflow-critical decisions
- Task segmentation to stop privilege escalation across interconnected agents
- Multi-agent validation protocols to prevent spread of malicious reasoning
- Rate limiting and agent-specific execution quotas against flooding
- Limit cross-communication by functional role; apply topology segmentation to minimise attack surface
Reactive
- Real-time detection models flagging rogue behaviour, including in inter-agent communication
- Isolate rogue agents together with their communication history and memory — quarantine the state, not just the process
- Revoke or downgrade privileges pending review
- Auto-disable unauthorised agent processes
- Track reappearance attempts — rogue agents “rejoin the network under a different identity”
Detective
- Monitor for unexpected role changes and task assignments
- Log agent-to-agent communication; detect out-of-band requests
- Detect trust-score deviations “including propagation events”
- Track decision approval discrepancies — denied actions later approved by a different agent, and repeated overrides
- Monitor execution rates for abuse patterns
- Monitor decision consistency across similar cases — contradictory decisions in similar scenarios indicate manipulation
Topology segmentation and role-scoped communication are the highest-leverage controls: they shrink the graph the attacker traverses in T14 and limit infectious-backdoor blast radius in T13. Decision-approval-discrepancy tracking is the one control that catches Orchestration Hijacking and Cross-Agent Approval Forgery, both of which look clean to every individual agent.
Related pages
- agentic-threat-taxonomy — T12, T13, T14 in context
- agentic-reference-architecture — inter-agent communication and coordinating agents
- inter-agent-protocol-abuse — T16, the protocol layer these run over
- cascading-hallucination — T5, the propagation analogue
- identity-and-privilege-threats — shadow agent deployment, the T3 route into T13
- agentic-mitigation-playbooks — Playbook 6 in full