Architecture Matters for Multi-Agent Security

Multi-agent systems (MAS), composed of networks of two or more autonomous AI agents, have become increasingly popular in production deployments, yet introduce security risks that do not arise in single-agent settings. Even if individual agents may exhibit robust security, architectural decisions governing their coordination can create attack surfaces that have not been systematically characterized. In this work, we present an empirical study of how MAS design decisions shape the tradeoff between task performance and attack resistance. Using a network of web-based agents and stage-wise evaluations that distinguish planning-stage refusal, execution-stage interception, and successful attack completion, we study architectural choices through controlled experiments. We identify three key design choices that influence MAS security: (i) agent roles, which determine how authority and responsibility are allocated; (ii) topology, which shapes how and when agents interact; and (iii) memory, which determines the context and state visibility accessible to each agent. Overall, our results show that security and performance in multi-agent systems are governed by architectural design choices, motivating the development of further evaluations which move beyond the security properties of a single agent.

When you ask an AI assistant to write malware, it usually refuses. But modern AI systems are no longer lone assistants. They are increasingly built as teams of agents that split up a job, pass messages, and hand tasks to one another. We wanted to know how specific choices in how you wire agents together changes their safety. To find out, we tested the same AI models in different team arrangements across three settings: browsing the web, controlling a computer, and writing code. We varied which agent does what, how the agents talk, and what each one is allowed to see. These agent teams turned out to be easier to misuse than single agents doing the same job, sometimes by a factor of nearly four, even while handling legitimate tasks equally well. The effects are complex and varied. Sometimes, no single agent ever sees enough to recognize the danger and say no, but other times, it seems like no agent really “takes responsibility” for saying no, even when they can see enough. This means that small design choices in agent teams have large security impacts, ones that current safety testing tends to miss.