Human Attacks on Multi-Agent Systems

Adversaries exploit inter-agent delegation, trust relationships, and workflow dependencies — rather than attacking a single agent directly — to escalate privilege or manipulate AI-driven operations across the system. In a multi-agent system: An attacker repeatedly re-routes a request between two interdependent agents so each treats the other's prior handling…

Use this profile to understand the building block briefly, place it in the model, and switch to the 360° assessment when needed.

Content type

Concept

Theoretical construct: explains a term, principle, or mental model.

Classification level

Structure

What organizes, connects, or makes decisions possible.

Available perspectives

Open this building block directly in an already curated view.

360°

In brief

Human attacks on multi-agent systems in brief

Human attacks on multi-agent systems are deliberate interventions that manipulate or abuse agents, their communication, or their tools.

Where does it come from?

The topic grew from security analysis of agentic systems as greater autonomy and coupling exposed new attack surfaces. OWASP describes it as a threat category for agentic AI; it has no single originator.

The mental model

An attacker may craft inputs, steal credentials, induce risky handoffs, or misuse tools. In a multi-agent system, a compromised agent can propagate false or harmful instructions. Trust boundaries, least privilege, approval for consequential actions, and logging can break the chain.

Key building blocks

Manipulation

People alter input or context to influence an agent's decisions and handoffs.

Propagation

A compromised agent can spread false or harmful instructions to other agents.

Containment

Permissions, approvals, and isolation limit the consequences of an attack.

When is it useful?

The category is central to the design, operation, and governance of agentic systems. Controls must cover the whole agent network, tools, identities, and human operating errors.

OWASP Agentic AI — Threats and Mitigations (T14 — Human Attacks on Multi-Agent Systems)

Why is this building block relevant?

Adversaries exploit inter-agent delegation, trust relationships, and workflow dependencies — rather than attacking a single agent directly — to escalate privilege or manipulate AI-driven operations across the system.