ATLAS: Adaptive Topology-Level Attack Synthesis for Probing Multi-Agent Systems

Production multi-agent AI systems delegate tasks, share memory, and call tools across trust boundaries, yet most existing adversarial attacks evaluate one agent at a time. We present ATLAS, an attack algorithm designed for multi-agent topologies. ATLAS profiles defenses across six dimensions, routes attacks through eight structural modes via an MDP with Bellman value propagation, and recovers verbally compliant but unexecuted attacks by retrying through alternative delegation paths. On 25 objectives mapped to the OWASP Top 10 Agentic Risks, across four enterprise scenarios (FinOps, DevSecOps, Healthcare, SOC) and four target models, ATLAS achieves 85.9% attack success rate (ASR) with 5.7 queries per objective, compared with GOAT (82.5%, 10.7q), TAP (75.3%, 9.3q), and Crescendo (63.1%, 10.7q): a 47% reduction in attack budget. All results are scored with tool execution evidence rather than verbal compliance. Across ten models we observe a capability–security inversion: GPT-4.1 (62.9%) is markedly less secure than GPT-4o-mini (38.6%), while Claude Opus 4.6 resists 99.3% of attacks.