Researchers discover new attack method that exploits multi-agent AI systems — existing safety tools fail to stop it

Researchers at arXiv published a study showing that AI systems using multiple interacting agents (separate AI decision-makers working together) have a previously unknown vulnerability. An attacker can hide malicious instructions across two different agents — one piece in a user's message, another in a compromised remote agent — that individually look harmless but activate dangerous behavior when the system routes them together. Current safety filters like PromptGuard and Llama-Guard miss these "conjunctive" attacks because they only check individual messages, not interactions across agents.

Unlike past attacks that require changing the AI model's code or weights, this method works by only controlling where the attack pieces are placed and inserted — making it cheaper and easier to execute. The researchers tested it across different system layouts (star, chain, and network topologies) and found that targeting the routing logic (how agents talk to each other) increased attack success rates substantially while keeping false alarms low, meaning attacks slip through undetected.

Teams building multi-agent AI systems — chatbots that use tool-calling agents, customer service systems with specialized AI workers, or enterprise automation — cannot rely on existing safety testing to catch these attacks. Your company's AI safety checklist likely only tests single agents in isolation, leaving gaps when those agents talk to each other. This matters now because multi-agent architectures are becoming standard as companies scale AI beyond simple chat.