red-teaming-multi-agent-systems

# Red-teaming multi-agent systems: the edges between agents are attack surface A single agent has one context to defend. A system of agents has one per agent plus every channel between them, and those channels are the new surface. When one agent's output becomes another's input, and any agent in the chain can be steered by external content, the steering propagates across agents that each "trust" their peer. The vulnerabilities here do not exist in a solo agent; they are born from the wiring. ## When to use - You are reviewing an orchestrator, a crew/swarm, or an agent-to-agent (A2A) protocol where agents route work to each other. - Any pipeline where one agent's output feeds another agent as instructions. - Agents share memory, a task queue, or a blackboard, or can spawn or delegate. ## Scope check Test agent systems you own or are authorized to test. Use benign, marked payloads; never drive real privileged actions against systems you do not control. If you can't name the authorization, stop. ## The loop 1. **Map the topology and the trust edges.** Diagram every agent and every directed edge: who can message, spawn, or delegate to whom. Mark the edges that cross a trust boundary, where a lower-trust or externally-influenced agent feeds a higher-privileged one. Each edge where output becomes another agent's instructions is an internal injection channel. 2. **Treat every inter-agent message as untrusted content.** If agent B acts on agent A's text as in...