A subagent with read-only calendar access returns a meeting summary. One line is formatted as an orchestrator instruction. The orchestrator, which has write access to email, sends a message it was never asked to send. No agent exceeded its documented permissions.
The vulnerability is not in any individual agent. It is in the assumption that output from a trusted agent is safe to consume without verification at the orchestrator boundary. In multi-agent systems, the effective privilege ceiling is the least-defended subagent connected to the most-privileged orchestrator, not the orchestrator itself. Each delegation hop adds attack surface without adding defense.
The privilege model breaks at the first delegation hop
Classical access control maps a principal to a resource. Multi-agent delegation breaks that mapping. The moment an orchestrator consumes subagent output without re-verification, the system's effective privilege becomes the union of all reachable agent privileges.
The OWASP Agentic AI Top 10 2026 (ASI07) documents this with a financial example. A read-only agent processes a phishing email and passes the task to a finance agent that implicitly trusts email-sourced instructions. The result is an unauthorized payment. No agent was compromised; the composition was the vulnerability.
CSA (March 2026) identified 3 structural gaps: no scope attenuation at delegation, no cryptographic lineage on tokens across hops, no context preservation between turns. SANS CB4A is more direct. A single agent accumulates credentials for cloud, email, repositories, ticketing, and SaaS. The blast radius is the union of all held credentials, and each node added to the graph expands that radius.
Three attack patterns, one root assumption
All trust chain attacks exploit the same assumption: output from a trusted agent is safe to consume without re-verification at the orchestrator boundary. Three distinct patterns exploit this at different layers.
Output injection. Prompt Infection (arXiv:2410.07283, ESORICS 2025) demonstrated LLM-to-LLM injection that self-replicates across agent networks, including through private inter-agent communication channels. The subagent returns text formatted as system instructions. The orchestrator processes it as authoritative, and propagation continues autonomously without additional attacker action.
Trust escalation. The OWASP ASI07 example: a read-only agent causes a write operation. No agent was compromised. The composition of two agents with separate permissions created an attack path that neither held individually.
Cross-agent configuration poisoning. In September 2025, Rehberger and Willison demonstrated this chain in detail. A compromised GitHub Copilot writes a malicious MCP server entry into Claude Code's CLAUDE.md file. On the next startup, Claude Code loads the poisoned config and connects to an attacker-controlled server. In February 2026, the Cline incident realized this chain in production. A GitHub issue title injection triggered an authenticated Claude session. Attacker-controlled software was distributed to approximately 4,000 developer machines.
The framework is the propagation mechanism
LangGraph, CrewAI, AutoGen, and MCP orchestrators operate with trust-by-default for inter-agent messages. The framework's own message-passing is the channel through which a compromise propagates, and this is not a bug in any individual agent.
CrewAI issue #5153 exposes the problem: role-label-based trust, no cryptographic verification per edge. Compositional trust, where effective trust reflects the full delegation chain, is unavailable in any major production framework. CVE-2025-54136 (CVSS 8.8, July 2025) quantified the result: attack success above 60% across 45 real-world MCP servers. An internet scan in July 2025 found 1,862 publicly accessible MCP instances responding to unauthenticated requests.
arXiv:2601.11893 (SEAgent, January 2026) formalized the gap with a mathematical proof: current agent systems have no mandatory access control between agents. arXiv:2503.12188 (Triedman et al., 2025) demonstrated the practical consequence: arbitrary malicious code execution via trust chain exploitation. Agents execute code from tool outputs without verifying tool server identity across hops.
The metric that exposes the real risk
The wrong security analysis focuses on what each individual agent can do. The correct analysis maps the maximum privilege reachable from any entry point via any valid path in the delegation graph. That graph-theoretic view reveals why fixing individual nodes while ignoring graph edges changes nothing about the actual attack surface.
SEAgent (arXiv:2601.11893) established that the information flow graph is the correct unit of analysis. Security policy must be enforced on graph edges, the agent-to-agent interactions, not only on nodes. Prompt Infection confirmed the consequence: a single initial injection propagates through the network silently. Defense at the entry node is not sufficient.
The MAGO Intel tool (intel.mago.team) maps agent trust graphs in production deployments. It identifies the maximum privilege reachable from any entry point and flags paths where low-privilege agents connect to high-privilege orchestrators without scope attenuation. Node-level defenses, such as system prompt hardening or isolated agent testing, do not reduce the graph's reachable privilege set. The metric that matters is not the configuration of any individual node.
Three controls that operate on the graph, not the node
Improving individual agent system prompts does not reduce the attack surface of the delegation graph. Three controls enforce trust at graph edges and change the risk calculation.
Cryptographic workload identity per hop. SPIFFE/SPIRE issues short-lived SVIDs per agent instance. Each hop presents a verifiable identity that cannot be self-declared. The receiver verifies the calling agent's identity and rejects out-of-scope requests. CSA and SANS identify this as the minimum acceptable posture for regulated deployments.
Output context isolation before orchestrator re-injection. Treat all subagent output as untrusted external input, regardless of the subagent's nominal role. Apply the same sanitization used for external API responses to all inter-agent messages. This makes the orchestrator's trust boundary explicit rather than implicit.
Token attenuation on delegation. Macaroons or OIDC token exchange with narrowed scope at each hop. Subagents receive tokens with minimum scope for their subtask, not a copy of the orchestrator's full token. Biscuit tokens support cryptographically verified offline permission reduction across hops. A subagent cannot cause write operations regardless of what it returns, because its token does not authorize writes.
Every delegation hop is a confused deputy you did not authorize. The privilege ceiling of a multi-agent system is the maximum reachable across all valid agent paths, not the orchestrator's documented permissions. Frameworks that assume trust at graph nodes, not at graph edges, leave each subagent as a new entry point into your most privileged operations.
Top comments (0)