Cross-Agent Attack Detection
In systems where multiple AI agents talk to each other, an attacker can craft messages that impersonate a trusted agent, forge system-level tags, or sneak manipulative instructions into inter-agent traffic. This exploits the trust agents place in each other to get unauthorized actions performed, extract data, or bypass safety controls.
How the attack works
An attacker sends a message into a multi-agent workflow that pretends to come from another legitimate agent, or that embeds a fake 'system' or 'orchestrator' tag. The receiving agent, trusting the apparent sender, treats the injected content as legitimate instructions or status updates. This can be used to bypass the orchestrator that normally supervises message flow, insert false error or status reports to mislead the agent's decision-making, or manipulate message formatting conventions so the target agent misreads intent. The end result is the target agent performing actions, leaking data, or ignoring safety checks it would not otherwise have accepted.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 0376fe06-365a-42ee-91b8-d994cb723bca
- Severity
- Critical
Why it matters
An organization running multi-agent AI pipelines can have one compromised or malicious agent manipulate others into taking unauthorized actions, leaking sensitive data, or skipping safety checks, effectively turning inter-agent trust into an attack surface.
What you can do
- →Require agents to authenticate the true origin of inter-agent messages rather than trusting sender-claimed identity fields.
- →Have a central orchestrator validate and tag messages with verified sender metadata before routing them, and reject messages that carry unverified system-level tags.
- →Log and review inter-agent messages for injected instructions, forged status/error content, or unusual delegation patterns.
- →Separate legitimate agent-to-agent delegation (with clear authorization records) from ad hoc messages, and flag delegation that lacks an audit trail.
Known benign look-alikes
- Legitimate agent delegation where one agent is authorized to act on behalf of another
- Orchestrator agent routing messages with original sender metadata
- Agent discussing prompt injection as a topic in security-related tasks
- Authorized system reconfiguration commands through proper admin channels