Multi-Agent Consensus Poisoning and Sybil Attack
Some AI systems use several agents that vote or reach consensus before taking an action. This rule flags attempts to game that process by injecting content that impersonates multiple agents, forges votes, or otherwise stuffs the decision process to force a particular outcome.
How the attack works
An attacker sends input that mimics messages or votes from several distinct agents rather than one, creating the appearance of independent agreement (a Sybil attack). The injected content may forge consensus votes, submit coordinated fake proposals, or repeat submissions to overwhelm legitimate votes. The goal is to push the multi-agent system's shared decision-making toward an outcome the attacker wants, without controlling a majority of real agents. This targets the trust assumption that each vote or proposal comes from a distinct, honest agent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e9492afa-81f2-4f36-a86b-112086eed22b
- Severity
- Critical
Why it matters
If successful, an attacker can steer decisions made collectively by an agent system — such as approving an action, releasing data, or executing a task — even though they don't legitimately control enough agents to win a fair vote.
What you can do
- →Require cryptographic or otherwise unforgeable identity verification for each agent participating in consensus, not just a claimed name or ID.
- →Set limits on how many proposals or votes a single identity or source can submit within a time window.
- →Log and review consensus decisions where the outcome flips based on a small number of late or unusual votes.
- →Separate the channel agents use to communicate proposals/votes from any channel that accepts external or untrusted input.
Known benign look-alikes
- Discussions about Sybil attack defenses in distributed systems research
- Academic paper discussing how Sybil attacks work in peer-to-peer networks with quoted example attack descriptions
- Red team security exercise documentation describing consensus manipulation test scenarios