# Multi-Agent Consensus Poisoning and Sybil Attack

- **Severity:** Critical
- **Signature ID:** `e9492afa-81f2-4f36-a86b-112086eed22b`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Some AI systems use several agents that vote or reach consensus before taking an action. This rule flags attempts to game that process by injecting content that impersonates multiple agents, forges votes, or otherwise stuffs the decision process to force a particular outcome.

## How the attack works

An attacker sends input that mimics messages or votes from several distinct agents rather than one, creating the appearance of independent agreement (a Sybil attack). The injected content may forge consensus votes, submit coordinated fake proposals, or repeat submissions to overwhelm legitimate votes. The goal is to push the multi-agent system's shared decision-making toward an outcome the attacker wants, without controlling a majority of real agents. This targets the trust assumption that each vote or proposal comes from a distinct, honest agent.

## Why it matters

If successful, an attacker can steer decisions made collectively by an agent system — such as approving an action, releasing data, or executing a task — even though they don't legitimately control enough agents to win a fair vote.

## What you can do

- Require cryptographic or otherwise unforgeable identity verification for each agent participating in consensus, not just a claimed name or ID.
- Set limits on how many proposals or votes a single identity or source can submit within a time window.
- Log and review consensus decisions where the outcome flips based on a small number of late or unusual votes.
- Separate the channel agents use to communicate proposals/votes from any channel that accepts external or untrusted input.

## Known benign look-alikes

- Discussions about Sybil attack defenses in distributed systems research
- Academic paper discussing how Sybil attacks work in peer-to-peer networks with quoted example attack descriptions
- Red team security exercise documentation describing consensus manipulation test scenarios

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00092

---
Source: https://www.netzilo.com/threats/atr-multi-agent-consensus-poisoning-and-sybil-attack