Paper deep dive

Security Considerations for Multi-agent Systems

Tam Nguyen, Moses Ndebugre, Dheeraj Arremsetty

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 800

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/13/2026, 12:57:17 AM

Summary

This paper presents a systematic study of security vulnerabilities in Multi-Agent Systems (MAS), identifying 193 distinct threat items across nine categories. It evaluates 16 security frameworks, finding that none provide majority coverage for any category, with 'Non-Determinism' and 'Data Leakage' being the most under-addressed. The study proposes a four-phase methodology for threat modeling and provides evidence-based guidance for framework selection, highlighting the OWASP Agentic Security Initiative and CDAO Generative AI Responsible AI Toolkit as leaders in different operational phases.

Entities (5)

ATFAA-SHIELD · security-framework · 100%CDAO Generative AI Responsible AI Toolkit · security-framework · 100%Multi-agent Systems (MAS) · system-architecture · 100%NIST AI Risk Management Framework · security-framework · 100%OWASP Agentic Security Initiative · security-framework · 100%

Relation Signals (3)

OWASP Agentic Security Initiative → leadsincoverage → Design Phase

confidence 95% · OWASP Agentic Security Initiative leads overall at 65.3% coverage and in the design phase

CDAO Generative AI Responsible AI Toolkit → leadsincoverage → Development and Operational Phases

confidence 95% · the CDAO Generative AI Responsible AI Toolkit leads in development and operational coverage

Multi-agent Systems (MAS) → exhibitsvulnerability → Non-Determinism

confidence 90% · Non-Determinism (mean score 1.231 across all 16 frameworks) and Data Leakage (1.340) are the most under-addressed domains.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Multi-agent artificial intelligence systems or MAS are systems of autonomous agents that exercise delegated tool authority, share persistent memory, and coordinate via inter-agent communication. MAS introduces qualitatively distinct security vulnerabilities from those documented for singular AI models. Existing security and governance frameworks were not designed for these emerging attack surfaces. This study systematically characterizes the threat landscape of MAS and quantitatively evaluates 16 security frameworks for AI against it. A four-phase methodology is proposed: constructing a deep technical knowledge base of production multi-agent architectures; conducting generative AI-assisted threat modeling scoped to MAS cybersecurity risks and validated by domain experts; structuring survey plans at individual-threat granularity; and scoring each framework on a three-point scale against the cybersecurity risks. The risks were organized into 193 distinct main threat items across nine risk categories. The expected minimal average score is 2. No reviewed framework achieves majority coverage of any single category. Non-Determinism (mean score 1.231 across all 16 frameworks) and Data Leakage (1.340) are the most under-addressed domains. The OWASP Agentic Security Initiative leads overall at 65.3\% coverage and in the design phase; the CDAO Generative AI Responsible AI Toolkit leads in development and operational coverage. These results provide the first empirical cross-framework comparison for MAS security and offer evidence-based guidance for framework selection.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

799,503 characters extracted from source content.

Expand or collapse full text

Security Considerations for Multi-agent Systems* * A Crew Scaler (501c3 pending org)’s response to NIST RFI 2026-00206 1 st Tam Nguyen Founder, CTO @ Crew Scaler US Federal Employee t@crewscaler.org ORCID 0000-0002-8577-8342 2 nd Moses Ndebugre Senior Researcher @ Crew Scaler North Carolina A&T State University myndebugre@aggies.ncat.edu ORCID 0000-0002-6941-6675 3 rd Dheeraj Arremsetty Advisory Board Member @ Crew Scaler AI Technical Solution Architect dheeraj.arremsetty@gmail.com ORCID 0009-0001-5654-6286 Abstract—Multi-agent artificial intelligence systems or MAS are systems of autonomous agents that exercise delegated tool au- thority, share persistent memory, and coordinate via inter-agent communication. MAS introduces qualitatively distinct security vulnerabilities from those documented for singular AI models. Existing security and governance frameworks were not designed for these emerging attack surfaces. This study systematically characterizes the threat landscape of MAS and quantitatively evaluates 16 security frameworks for AI against it. A four- phase methodology is proposed: constructing a deep technical knowledge base of production multi-agent architectures; con- ducting generative AI-assisted threat modeling scoped to MAS cybersecurity risks and validated by domain experts; structuring survey plans at individual-threat granularity; and scoring each framework on a three-point scale against the cybersecurity risks. The risks were organized into 193 distinct main threat items across nine risk categories. The expected minimal average score is 2. No reviewed framework achieves majority coverage of any single category. Non-Determinism (mean score 1.231 across all 16 frameworks) and Data Leakage (1.340) are the most under-addressed domains. The OWASP Agentic Security Initiative leads overall at 65.3% coverage and in the design phase; the CDAO Generative AI Responsible AI Toolkit leads in development and operational coverage. These results provide the first empirical cross-framework comparison for MAS security and offer evidence-based guidance for framework selection. Index Terms—agentic AI security, multi-agent systems, threat taxonomy, security frameworks, AI risk management I. INTRODUCTION AI systems are crossing a critical threshold. Modern agentic AI systems exercise delegated authority over tools, databases, external APIs, and coordinating peer agents, au- tonomously planning and executing multi-step tasks with minimal human intervention [1]. Enterprise deployments have moved from experimentation to infrastructure such as agents that schedule cloud operations, write and execute code, manage financial workflows, and orchestrate one another at production scale [2]. This delegation of autonomous action introduces a class of security concern that differs from those governing traditional software systems. The security community has responded with a growing body of frameworks. NIST’s AI Risk Management Frame- work [3] and its adversarial machine learning companion Correspondingauthor.DirectallinquiriestoTamNguyenat t@crewscaler.org. AI 100-2e2025 [4] establish governance structures and threat taxonomies for AI systems broadly. MITRE ATLAS [5] catalogs adversary tactics and techniques against AI-enabled systems, modeled after the ATT&CK framework. The OWASP Agentic Security Initiative [6], ATFAA-SHIELD [7], and the CDAO Generative AI Responsible AI Toolkit [8] represent more recent, agent-oriented efforts. Together, these and thir- teen additional frameworks constitute the practitioner’s current reference landscape for agentic AI security. Yet a fundamental gap persists. Most existing frameworks share security assumptions suited to traditional systems: de- terministic control flow, bounded trust boundaries, stateless execution, and identifiable adversarial inputs. None of these hold for MAS. When autonomous agents share persistent memory, propagate tool authorization across delegation chains, and influence one another’s reasoning through shared context, the security surface becomes behavioral and emergent rather than structural and bounded. Policy-level remote code execu- tion through tool coupling, latent memory poisoning via shared vector databases, self-replicating prompt worms propagat- ing through inter-agent communication, and non-deterministic planning divergence as an assurance gap represent attack patterns for which few established countermeasure catalog exists in any currently reviewed framework [9]. Practitioners also lack empirical, cross-framework coverage data to guide security architecture decisions. We present a systematic four-phase study: construction of a deep technical knowledge base spanning the full archi- tectural surface of production MAS; generative AI-assisted threat modeling scoped explicitly to threats qualitatively dis- tinct from single-agent risks, validated by NVIDIA-certified agentic AI professional; structured survey planning at indi- vidual risk granularity; and quantitative scoring of sixteen security frameworks against the resulting risk taxonomy. The risk taxonomy comprises 193 distinct main items across nine risk categories: Agent-Tool Coupling, Data Leakage, Injection, Identity and Provenance, Memory Poisoning, Non- Determinism, Trust Exploitation, Timing and Monitoring, and Workflow Architecture. Scoring each framework against every item on a three-point scale yields the first empirical cross- framework comparison for MAS security. The specific contributions of this work are: arXiv:2603.09002v1 [cs.CR] 9 Mar 2026 • A taxonomy of 193 agentic AI security threats across nine categories, systematically derived from production multi-agent architectures and explicitly scoped to threats qualitatively distinct from those affecting singular, state- less AI systems. • A quantitative comparative analysis of sixteen security and governance frameworks, producing per-category cov- erage scores, lifecycle phase rankings across design, development, and operational phases, composite maturity scores, and identification of five threat items receiving no coverage from any reviewed framework. • Evidence-basedframeworkselectionguidance: OWASP ASI leads overall at 65.3% coverage and dominates the design phase; CDAO GenAI leads in development and operational coverage; ATFAA-SHIELD provides the highest architectural specificity among non-OWASP frameworks. • A forward-looking characterization of how agentic AI threats mature from theoretical construction through proof-of-concept demonstration to active exploitation, informing practitioner prioritization and identifying di- rections where future framework development is most urgently needed. Section I describes the four-phase methodology. Sec- tion I catalogs the threat taxonomy. Section IV analyzes how individual threats evolve over time. Section V surveys the sixteen frameworks. Section VI presents the quantitative coverage analysis. I. METHOD The methodology proceeded in four sequential phases designed to be systematic and exhaustive with respect to the threat landscape specific to production-grade multi-agent AI systems. Phase 1 — System knowledge base construction. The foundation of this work is a comprehensive technical de- scription of modern agentic AI systems, developed across 86 chapters organized into ten thematic parts: agent fundamentals; framework and tool integration; evaluation and optimization; production deployment and scaling; advanced reasoning and decision making; retrieval-augmented generation; the NVIDIA NeMo framework; reliability and cost management; safety and governance; and human-in-the-loop integration. The ma- terial addresses concrete architectures in substantial depth. At the component level, this includes graph-based stateful orchestration, function calling mechanics, multi-agent com- munication protocols (REST, gRPC, and agent cards), vector database integration, and NeMo Guardrails rail types. At the system level, it addresses ReAct reasoning cycles, hierarchical planning, hybrid RAG with knowledge graphs, RLHF-based alignment, and approval-workflow design for human oversight. Multi-agent-specific phenomena receive particular attention: emergent behavior in swarm configurations, Nash equilibrium dynamics in competitive agent settings, cross-agent memory sharing, federated orchestration, and the interaction of non- determinism with safety assurance. The resulting knowledge base spans thousands of pages and served as the primary substrate for subsequent threat analysis. Phase 2 — Generative AI-assisted threat modeling. Rather than relying solely on expert judgment or existing taxonomies, the second phase employed generative AI to conduct system- atic threat modeling against the system descriptions produced in Phase 1. For each structural component, integration bound- ary, and operational pattern described in the knowledge base, targeted prompts directed the model to reason adversarially about potential security threats, risks, and vulnerabilities. Critically, prompts required the model to articulate why each identified threat is qualitatively distinct from risks already documented for singular, stateless AI systems, preventing conflation with findings already addressed by NIST publi- cations such as AI 100-2e2025, the AI Risk Management Framework, SP 800-218A, and related work. This constraint also ensured that multi-agent-emergent risks—those arising specifically from agent coordination, shared state, delegated authority, and distributed tool access—received distinct treat- ment rather than being subsumed under known single-agent attack patterns. The first-pass analysis yielded approximately 1,700 candidate threats organized across twelve risk domains, covering concerns such as policy-level remote code execu- tion through tool coupling, data leakage via large-context probabilistic recall, memory poisoning and latent backdoor activation, non-determinism as an assurance gap, telemetry blind spots in cognitive behavior, multi-agent trust exploitation and self-replicating prompt malware, and workflow attacks tar- geting RAG pipelines and plugin ecosystems. To validate the plausibility and technical accuracy of these outputs, an initial expert review was conducted by an NVIDIA-certified profes- sional in agentic AI systems. This first review round assessed whether the identified threats were technically grounded, cor- rectly scoped to multi-agent configurations, and sufficiently distinct from single-agent or traditional software risks. Threats found to be redundant, mischaracterized, or outside scope were either revised or removed, while the reviewer’s domain expertise informed refinements to threat descriptions that had been articulated imprecisely by the model. Phase 3 — Threat-level survey planning. The third phase operationalized the Phase 2 output into a structured survey plan. For each of the approximately 1,700 identified threats, a tailored search string was constructed and relevance criteria were defined in terms of applicability to production multi- agent deployments, novelty relative to the existing literature, and empirical or theoretical grounding. Granularity was main- tained at the individual threat level rather than the category level, a deliberate design choice to avoid the imprecision endemic to broader survey scoping. The plan further classified threats along a maturity axis: those already operationalized in the wild, those supported by theoretical argument or proof-of- concept demonstration, and those identified as emergent risks warranting forward-looking treatment. Phase 4 — Survey execution with temporal and continuous analysis. The fourth phase, currently underway, executes the survey plans from Phase 3 for each individual threat. Execution couples conventional literature search with continuous survey- ing to track future developments, reflecting the rapid pace at which the agentic AI threat landscape evolves. Temporal analysis further examines how individual threats mature over time—from theoretical construction through proof-of-concept demonstration to active exploitation—providing a develop- mental arc rather than a static snapshot. The findings presented in the following section reflect the completed outputs of Phases 1 through 3 and early results from Phase 4, constituting a rigorous but necessarily evolving characterization of the threat landscape for AI agent systems. I. SECURITY THREATS, RISKS, AND VULNERABILITIES AFFECTING AI AGENT SYSTEMS A. Agent–tool coupling as “policy-level remote code execu- tion” Agentic AI distinguishes vulnerabilities in underlying tools from vulnerabilities in agent policy that orchestrates them. At- tackers controlling model decisions can indirectly commandeer powerful tools without exploiting code-level flaws. Distinct threats include: Tool-mediated compromise where successful prompt or observation injection enables agents to browse malicious sites, download and run code, mod- ify configurations, or reconfigure SaaS systems. This achieves practical ”RCE” via high-privilege tools despite no classical RCE vulnerability existing. Thought-and observation-level attacks where attackers perturb internal reasoning or tool- selection steps while keeping final natural-language answers benign. Output-focused guards detect nothing suspicious while underlying systems face compromise. This ”policy-level RCE” differs qualitatively from manip- ulating fixed, deterministic control-flow graphs. 1) RATC 1 - UI/UX Abstraction and Visibility Gaps: RATC 11 - Approval Workflow Risk Calibration Failure Through Tool Abstraction. Approval UIs present tool in- vocations through abstraction layers that simplify complex operations into human-readable descriptions. masking true risk levels. When ”Update customer record” hides direct SQL modifications to production databases, humans approve based on benign abstractions rather than actual risks. Multi-agent systems amplify this. For example, approval UIs show Agent A’s high-level intent while hiding that Agent B invokes pay- ment APIs, Agent C modifies financial databases, and Agent D triggers notifications—each with distinct failure modes. The structured presentation collapses dangerous multi-tool sequences into single approval buttons. RATC12 - Progressive Disclosure Concealment of Tool Chain Complexity. Progressive disclosure patterns hide tech- nical details in expandable sections. creating visibility gaps where users approve without understanding complete tool in- vocation chains. In multi-agent systems, tool chains span agent boundaries and no single view presents complete execution graphs. For example, Agent A shows some tools, Agent B shows others, but UIs may not display the combined sequence when Agent A’s workflow triggers Agent B’s downstream workflow. RATC 13 - Tool Visibility Gaps Across Multiple UI Paradigms. Tool visibility issues span multiple UI patterns: inline suggestions execute tools invisibly without surfacing what runs or data accessed; chat interfaces display tool outputs as conversational messages without clearly indicating which tools executed; multimodal workflows hide tool chains behind natural language operations. In multi-agent systems. different agents’ tool outputs appear through different UI channels; hu- mans assembling a complete picture cannot see the integrated tool coupling. RATC 14 - Insufficient Tool Risk Differentiation in Multi-Agent Dashboards. Multi-agent dashboards display ac- tivities from multiple agents without differentiating tool invo- cations by risk level. treating file reads, database writes, API calls, and system commands with equivalent visual weight. Multi-agent dashboards aggregate agents with heterogeneous tool access such as some invoke only safe read-only tools, others execute privileged system commands, but unified pre- sentation obscures security boundaries where attackers trigger dangerous executions camouflaged as normal activity. RATC 15 - Context-Driven Tool Selection Without User Awareness. Context awareness features enable agents to auto- matically invoke tools based on conversation history and ses- sion state. creating policy-level RCE risks when users remain unaware of certain context-triggered executions. Multi-agent architectures amplify this risk because context propagates across agent boundaries. A tool-selection agent may invoke high-risk tools based on context established by earlier agents. Users beginning with low-risk queries may inadvertently en- able high-risk invocations through contextual drift without UI indication. RATC 16 - Trace Visualization Abstraction Concealing Tool Chain Complexity. Trace visualization creates hierarchi- cal drill-down to reveal nested operations. but attackers may weaponize this abstraction to hide malicious execution com- plexity. Multi-agent tools executing across agent boundaries become vulnerable because no single expanded view displays complete tool chains—each agent’s expansion shows only its own subset. 2) RATC 2 - Approval Workflow and User Attention Vul- nerabilities: RATC21 - Approval Fatigue Enabling Policy Bypass Through Multiple Contexts. Approval UIs routing excessive decisions to humans create approval fatigue. where reviewers approve without inspection because volume makes thorough review impractical. Multi-agent systems are uniquely vulnerable because distributed architectures generate exponen- tially more requests than singular agents. Attackers exploit fatigue by timing dangerous invocations during high-volume periods when users approve without inspection. RATC 22 - Keyboard Shortcut Hijacking in Approval Workflows. UI manipulation causes unintended approvals through keyboard shortcut exploitation when browser ex- tensions. injected JavaScript, or focus manipulation capture keystroke events. Attackers inject hidden dialogs and exploit auto-advance muscle memory. Multi-agent contexts amplify risk when approval decisions influence trust in other agents. RATC23 - Time-Based Default Exploit for Critical De- cisions. Exploitation of approval timeouts forces unauthorized action execution by triggering approvals when legitimate re- viewers are unavailable. Attackers strategically submit high- risk requests during coverage gaps or flood approval queues to overwhelm reviewers. Multi-agent systems amplify risk when agents coordinate routing across reviewers. each assuming others catch problems. 3) RATC 3 - Tool Overload, Parameter Handling, and Selection Errors: RATC 31 - Tool Overload Privilege Es- calation and Degradation Across Architectures. Multi-agent architectures with agents possessing different tool access lev- els or excessive tool counts create privilege escalation and selection degradation. Single-agent tool overload degrades performance with high tool selection error rates. In hierarchical delegation. attackers exploit cognitive overload to manipulate agents into executing privileged operations on behalf of other agents. Tool selection degradation cascades through delegation chains amplifying failures. RATC 32 - Tool Argument Injection and Parameter Ex- traction Errors. Tool calling argument errors become remote code execution vectors through argument injection across trust boundaries. When one agent constructs arguments from untrusted data and passes them to another agent for ex- ecution. probabilistic LLM generation enables attackers to inject malicious payloads as parameter values. Multi-agent architectures separate construction from execution, eliminat- ing single-agent self-validation, and downstream agents lack critical upstream security context. Parameter extraction errors compound through chained calls enabling amplification. RATC 33 - Tool Visibility Gaps in Inline Suggestion Pat- terns. Inline suggestion UIs display recommendations directly within workflows while executing tools invisibly. without surfacing what runs or what data they access. This creates policy-level RCE where tools execute from passive actions rather than explicit requests. Multi-agent systems amplify risk through distributed suggestion pipelines where each agent invokes tools invisibly and UIs present only final suggestions while concealing the distributed tool graphs generating them. RATC 34 - Tool Provenance Obscuration in Chat In- terface Tool Outputs. Chat interfaces display tool outputs as conversational messages without clearly indicating which tools executed. what parameters they received, or what privileges they used. Multi-agent chat interfaces obscure provenance further because outputs aggregate multiple agents’ invocations, with conversational presentation completely hiding which agent invoked which tools. 4) RATC 4 - Confidence Manipulation and Tool Autho- rization: RATC41 - Confidence Threshold Manipulation Attack. Adversarial prompt injection artificially inflates agent confidence scores to bypass approval gates where confidence- based gating determines automation levels. Multi-agent sys- tems face danger when agents trust confidence scores from other agents without validation. creating cascading failures. Confidence score inflation through majority voting occurs when all sampled reasoning paths converge on an answer due to manipulated input. RATC 42 - Tool Authorization Scope Confusion Across Agent Specializations. Agent authorization grants differ across specializations. In multi-agent systems. attackers compromise intermediate coordination agents that access multiple tool do- mains, enabling privilege escalation through an intermediary. Precondition validation bypass occurs when one agent verifies prerequisites but downstream agents assume verification is complete and skip rechecking, creating transitive trust where tools execute without verified prerequisites. 5) RATC 6 - Tool Metadata Poisoning Across Registries and Discovery: RATC61 - Centralized Tool Registry Poi- soning. Multi-agent systems sharing centralized tool registries face metadata poisoning attacks where compromising the registry enables manipulation of how all agents understand and invoke tools. Single-agent systems with embedded definitions limit poisoning while multi-agent shared registries create sin- gle semantic control points where changes affect all agents simultaneously. Vector database metadata poisoning causes semantic search to retrieve wrong tools; few-shot parameter examples in tool descriptions can embed malicious instructions appearing in agent context. RATC 62 - Framework-Specific Tool Selection Poi- soning. Framework architectures determine how agents se- lect tools. Attackers exploit framework-specific tool selection mechanisms by poisoning the decision context agents evaluate. Single-framework systems present one attack surface while multi-agent orchestrations across frameworks create multiple distinct surfaces scaling with the number of framework inter- action pairs. RATC 63 - Framework Abstraction Leakage Enabling Hidden Tool Chain Exploitation. Frameworks abstract tool invocation complexity. but this creates blind spots in multi- agent systems where tool chains become implicit rather than explicit. Multi-agent systems stack abstractions from multiple frameworks, creating multiple layers where policy-level RCE executes beneath different abstraction levels, making oversight inconsistent across the pipeline. 6) RATC 8 - Advanced Tool Invocation Patterns and Infer- ence: RATC81 - Tool Chain Exploitation Through Multi- Agent Replanning Loops. Dynamic replanning in Plan-and- Execute systems creates attack surfaces for iterative tool chain exploitation. Attackers induce controlled failures triggering replanning in other agents. progressively chaining innocuous tools into dangerous sequences. Single-agent replanning is bounded while multi-agent replanning creates cross-agent state accumulation without global consistency checks, with interac- tion pairs scaling quadratically in the number of agents. RATC 82 - Tool Result Injection and Observation Ma- nipulation. ReAct pattern’s explicit observation format be- comes attack vector in multi-agent systems where one agent’s tool outputs become another agent’s observations. Attackers inject malicious content formatted as tool results appearing legitimate. causing downstream agents to act on poisoned observations. Single agents validate their own outputs while multi-agent chains may trust upstream observations without re- validation, and streaming attacks enable progressive escalation injection that compounds across orchestration layers. RATC83 - Tool Schema Variation and Cross-Framework Boundaries. Different frameworks define tool schemas dif- ferently. and multi-agent systems mixing frameworks face schema translation layers where tool definitions transform. Attackers craft tool definitions exploiting transformation gaps where a parameter valid in one framework triggers silently- caught errors in another. Single-framework systems present one schema interface while multi-agent cross-framework or- chestration creates transformation boundaries scaling with framework interaction pairs. 7) RATC 9 - Web and Multimodal Tool Exploitation: RATC91 - Web Agent Tool Vulnerabilities. Web agents use specialized scraping tools to extract content from websites. Adversaries inject instructions into web content disguised as legitimate operational guidance. When multi-agent systems coordinate web scraping. injected instructions propagate as legitimate guidance across the pipeline. Web agents interacting with forms can encounter hidden fields containing instructions, and navigation logging tools can be manipulated to record incomplete audit trails. RATC 92 - Multimodal Retrieval and Vision Process- ing Vulnerabilities. Policy-level RCE in multimodal systems occurs when agents retrieve and execute tools based on poisoned multimodal content. In multi-agent RAG where retrieval agents select documents and synthesis agents in- voke tools. attackers poison multimodal content to ensure retrieval of malicious material. Vision model output laundering through multi-step processing causes malicious vision outputs to gain legitimacy through sequential agent processing. Cross- modal tool parameter injection enables attacks where multiple modalities contribute parameter segments without sanitization boundaries. 8) RATC 10 - Efficiency Optimization and Resource Con- straints: RATC101 - Token Allocation and Context Window Tuning. Working memory must allocate tokens across tool descriptions. prior tool results, and reasoning traces. In multi- agent systems, upstream agents operating under tight token budgets generate incomplete tool descriptions or truncated reasoning justifications, and downstream agents inherit these abbreviated descriptions selecting tools based on incomplete specifications. Attackers exploit by forcing upstream agents into constrained contexts that truncate safety-critical descrip- tions. RATC 102 - Iteration Budget and Temperature Tuning Trade-offs. Iteration budgets vary per agent specialization. Attackers craft tool sequences requiring many iterations suc- ceeding against high-budget agents but failing against con- strained ones. Temperature tuning exploits separate actual accuracy from confidence visibility; model selection diversity creates policy inconsistency where identical policy-level RCE succeeds against some models but fails against others. 9) RATC 11 - Tool Execution Infrastructure and Orches- tration: RATC111 - Service Orchestration and Discovery Attacks. API gateways implement tool routing policies select- ing which backend tool service processes requests. Attackers manipulate routing policies to redirect tool calls to attacker- controlled services or deprecated versions with vulnerabilities. In multi-agent microservices. the AI gateway layer centralizes tool selection logic—compromising routing enables intercept- ing all downstream tool calls across all agent services. Tool definitions propagating through service registries enable fleet- wide compromise when registries are poisoned. RATC 112 - Kubernetes and Container Orchestration Attacks. Container security contexts can be modified enabling privilege escalation. In multi-agent deployments. a single policy change affects all agent containers simultaneously. Persistent Volume Claims and sidecar proxies create addi- tional vectors where compromised configurations or proxies intercept tool calls across the fleet. Init containers establishing configurations before agent startup can inject malicious tool definitions affecting all subsequent operations. 10) RATC 12 - Distributed and Hardware-Level Attacks: RATC121 - Tensor Parallelism Communication Intercep- tion. Tensor parallelism distributes model computation across GPUs requiring inter-GPU communication. unencrypted by default. Tool-calling policy decisions computed on one GPU can be corrupted before reaching others. Single-agent tensor parallelism has one policy path while multi-agent systems where multiple agents’ policy computations flow through shared infrastructure enable compromising GPU communica- tion to hijack multiple agents’ tool selections simultaneously. RATC 122 - KV Cache and Quantization Attacks. Multi- user inference on shared GPUs with KV cache optimization enables one user’s agent to poison another’s cache with fabricated attention values. creating systematic bias toward specific tools. Attackers can also poison quantization calibra- tion datasets with malicious tool calls, biasing thresholds so downstream agents receive quantized outputs where parame- ters are corrupted toward attacker-optimized patterns. 11) RATC14 - Reasoning and Planning Vulnerabilities: RATC 141 - Chain-of-Thought Reasoning Quality Issues. Tool selection is vulnerable to intra-step correctness failures where agents make unsupported leaps. Poisoned reasoning traces can embed justifications for dangerous tool sequences that appear independently sound. and tool selection bias embedded in shared reasoning chains propagates attacker preferences to other agents through shared memory. RATC142 - Self-Consistency and Majority Voting Vul- nerabilities. Tool calling parameter injection through sam- pling path divergence exploits Self-Consistency where differ- ent paths arrive at different parameters. When all sampled paths converge on dangerous tools due to manipulated input. confidence artificially appears high. Quality-weighted voting in RASC can be exploited by manipulating assessment metrics to elevate scores for reasoning paths selecting dangerous tools. RATC 143 - Hierarchical and Tree-Based Planning Vul- nerabilities. Hierarchical task network planning creates tool visibility fragmentation where high-level planning lacks tool awareness and tool-level execution lacks strategic context. 12) RATC15 - Episodic Memory and Learning: RATC151 - Episodic Memory and Trajectory Poisoning. Episodes stored with action records document which tools solved similar problems. Attackers poison episodes record- ing malicious sequences as ”successful resolutions,” causing agents retrieving episodes to replicate malicious chains. Multi- agent tool coordination through shared episodic memory en- ables one agent’s compromise to propagate as learned policy affecting all agents. Trajectory abstraction converts poisoned episodes into dangerous procedural workflows. 13) RATC 16 - Semantic Memory and RAG: RATC161 - RAG Pipeline and Knowledge Base Poisoning. Seman- tic memory retrieval retrieves documents that agents use as context for tool selection. Attackers poisoning knowledge bases embed tool-invocation instructions in retrieved content. Knowledge graph relationship poisoning causes unsafe tool combinations to appear recommended; query rewriting instruc- tion injection affects all agents’ transformations. Knowledge base staleness causes agents to retrieve obsolete documentation invoking tools with obsolete formats. 14) RATC 17 - Utility Functions and Decision Logic: RATC171 - Utility-Weighted Tool Selection Poisoning. Expected utility calculation vulnerabilities exploit outcome assumption injection where false assumptions cause agents to miscalculate tool utility. Sequential expected utility mis- calculation occurs when intermediates misrepresent available future options. Trade-off weight manipulation poisons multi- objective utility functions balancing competing objectives. 15) RATC 18 - Rule-Based and Knowledge-Engineered Systems: RATC 181 - Rule-Based Tool Authorization By- pass. Rule-based authorization systems with specificity hierar- chies enable attackers injecting more-specific rules overriding safety rules. Forward chaining rule chain exploitation enables injecting facts triggering chains resulting in tool authorization. Certainty factor manipulation exploits how rules trust high- confidence facts bypassing risk assessment. Lexicographic heuristic objective reordering exploits sequential prioritization where rule injection reorders objectives causing wrong tool selections. 16) RATC 19 - Learning and Reinforcement Learning: RATC191 - Reinforcement Learning Tool Selection Poison- ing. Learned tool selection policy hijacking exploits reward poisoning where attackers train agents selecting malicious tools through reward signals. Multi-agent RL with shared replay buffers enables poisoned transitions affecting all agents’ learned Q-values. Curriculum learning poisoning injects ma- licious intermediate tasks; imitation learning trajectory poi- soning corrupts expert demonstrations. Actor-critic cross-agent critic poisoning provides false value estimates. and proximal policy optimization trust region manipulation enables attackers to iteratively converge agent policies toward dangerous attrac- tors. 17) RATC 21 - Parallel Retrieval Race Conditions in Multi-Agent Query Decomposition Systems: Parallel retrieval races occur when concurrent sub-queries retrieve from incon- sistent database states. Shared indexes cause deduplication races where agents simultaneously mark documents as seen, producing duplicates or incorrect deduplication. Timeout- triggered cancellations cascade across agents, overwhelming shared connection pools and causing fleet-wide retrieval out- ages. Multi-stage caching creates temporal inconsistency: per- stage TTLs expire at different times, causing queries to mix results from different knowledge states. Multi-agent cache sharing with network propagation delays causes agents to serve inconsistent results across the fleet. Container supply chain vulnerabilities through registry compromise enable fleet- wide poisoning during automated deployment. Centralized inference infrastructure creates single points of failure where authorization bypass, cache conflicts, and tensor parallelism failures affect all dependent agents simultaneously. 18) RATC 22 - Multi-Stage Pipeline Result Caching Race Enabling Multi-Agent Consistency Failures: Multi-stage pipeline caching creates race conditions where each stage’s TTL expires independently, producing temporal windows where queries return inconsistent results mixing stale and fresh data from different pipeline stages. Event-based cache invali- dation propagates sequentially across the agent fleet, causing agents to serve data from different knowledge states for minutes at a time. Shared caching infrastructure creates write races, hash collision attack surfaces where adversaries craft colliding queries to poison cache entries affecting all agents, and warming inconsistency where only a subset of agents benefit from pre-warmed caches. Centralized model serving containers distributed through registries introduce supply chain attack vectors—registry credential compromise, typosquatting, digest collision bypass, and GitOps automation enable fleet- wide backdoor deployment. Tensor parallelism communication between GPUs can be poisoned through multi-tenant col- location with insufficient memory isolation, corrupting syn- chronized activations affecting all forward passes. Profiling telemetry exposes fleet-wide dependency maps, cache patterns, and cost breakdowns that enable targeted DoS and budget exhaustion attacks against the highest-value bottlenecks. 19) RATC27 - MIG Instance Co-Location Creating Shared Physical GPU Failure Propagation Across Multi-Agent Deployments: Multi-Instance GPU (MIG) partitions GPUs into up to seven hardware-isolated instances with dedicated memory and compute. MIG provides hard isolation: one instance cannot degrade another’s performance. However, MIG logical isolation operates atop shared physical GPU hardware creating hidden dependencies. For example, power regula- tors, thermal management, PCIe interface, GPU firmware are shared. Power delivery failure, thermal throttling, PCIe error, or firmware hang affects all co-located instances. Firmware vulnerabilities can enable cross-partition memory access that breaks isolation fleet-wide despite MIG partitioning. The shared GPU driver stack means a single driver bug triggered by any tenant’s CUDA operation can cause fleet-wide outage affecting all customers simultaneously. 20) RATC 29 - Shared Workflow State Version Conflict Amplification Through Concurrent Write Flooding Creating Retry Storm Cascades: Production multi-agent workflows im- plement shared state coordination where agents track progress. Concurrent access requires optimistic locking: version num- bers increment on modification, write operations validate cur- rent version matches expected version. On conflict, systems raise exceptions preventing data corruption. However, high concurrency creates systematic version conflicts where many agents read at same version, work independently, then race to write with only first writer succeeding. Concurrent workflows generate retry storms that intensify contention rather than resolving it, delayed writes extend version epochs increasing stale reads, and more stale reads generate further conflicts in a positive feedback loop. Conflict probability scales quadratically with concurrency, and targeted collision bursts can exhaust retry budgets causing workflows to fail without completing. 21) RATC 30 - Guardrail Bypass Through Infrastructure Failure Injection Preventing Safety Validation Execution: Guardrails validation infrastructure requires GPU inference time, PII detection, and policy rule evaluation under timeout thresholds that prevent validation from blocking response delivery indefinitely. Adversary-induced processing delays ex- ceeding the timeout cause responses to bypass safety checks. Service unavailability attacks—through network flooding, re- source exhaustion, or denial-of-service against centralized validation endpoints—cause fleet-wide guardrail bypass when agents fall back to delivering unvalidated responses. B. New data-leakage channels via large contexts, logs, and probabilistic recall In traditional, schema-constrained systems, data flows are easier to restrict. With agents, free-form text encodes business logic, secrets, and deliberations, routinely copied between components and logs, expanding both the number and subtlety of leakage paths. 1) RDL 1 - UI/UX Patterns: RDL11 - Chat Interface Conversation History as Persistent Sensitive Data Repository. Chat interfaces accumulate sensitive data across entire ses- sions. creating persistent repositories without adequate access controls. In multi-agent systems, conversation histories aggre- gate credentials, PII, financial data, and proprietary content from multiple specialized agents into a single high-value tar- get. Each message persists in scrollable history where it can be exposed through screenshots, screen sharing, or compromised session storage. Unlike traditional applications that present sensitive data in dedicated secure views, multi-agent chat histories co-mingle sensitive and benign content, reducing user security vigilance and creating aggregated leakage risks that did not exist before agent integration. RDL12 - Progressive Disclosure Technical Views as Se- cret Exposure Vectors. Progressive disclosure UI patterns that hide technical details in expandable debug views create false security. as expanded views may expose credentials, tokens, and system internals without access controls or redaction. Multi-agent systems aggregate debugging information from multiple agents—including inter-agent authentication tokens, database connection strings, and API keys—into these views. The design principle of discoverability directly conflicts with the security principle of minimizing exposure surface. Unlike singular-agent systems that reveal only one component’s inter- nals, multi-agent debug views produce complete architectural maps with credentials, making a single expanded view a point of failure for comprehensive system compromise. RDL 13 - Context Awareness Session Persistence Across Security Boundaries. Session persistence features that restore state across reloads or devices create leakage risks when sensitive data from high-security contexts remains accessible after context shifts to lower-security environments. Multi-agent systems compound this by storing aggregated context from agents operating at different classification levels—security audit logs. HR records, and financial details—in a unified session store. The vulnerability is unique to multi-agent architectures because agents contribute different sensitivity levels to the same session, and the unified state retains all data across security-level transitions. Traditional applications maintain separate security contexts per data type, whereas multi-agent session persistence mixes security levels, enabling leakage whenever any access point is compromised. RDL 14 - Command Palette Recent History as Sensitive Operation Log. Command palette patterns that surface recently executed commands create persistent logs of sensitive user operations in browser storage and suggestion databases. In multi-agent systems. these logs span all integrated agents and reveal cross-agent operation sequences—exposing not just individual actions but behavioral patterns such as se- quential access to HR, finance, and email systems that can indicate insider threat activity. The learning mechanism that improves suggestions directly conflicts with data minimiza- tion principles. Unlike single-application histories, multi-agent palettes document comprehensive user behavior across entire ecosystems, producing high-value reconnaissance artifacts for attackers who compromise palette storage. RDL 15 - Multi-Agent Dashboard Aggregated Context Display. Multi-agent dashboards that display aggregated status and outputs from multiple agents simultaneously expose cor- relations between data sources that organizational policy, regu- lation, or security architecture intends to keep compartmental- ized. The vulnerability arises because agents operating under different access controls and serving different stakeholder groups are unified into a single view. An attacker or over- privileged user can derive sensitive insights from cross-domain correlation that no individual data source would reveal in isolation. Unlike role-based views in traditional applications, multi-agent dashboards aggregate complete system state across security boundaries by design. RDL 16 - Context Reference Links as Indirect Infor- mation Disclosure. Clickable reference links in context-aware interfaces expose sensitive information indirectly by revealing discussion topics. timing, and relationships between content items even when the content itself is partially redacted. In multi-agent systems, reference links span multiple agents’ contexts and create traversable information-flow graphs that expose organizational structures and decision-making pro- cesses. An attacker with conversation access can reconstruct sensitive business context by following link structure alone. Unlike intra-thread references in singular systems, multi-agent reference links create persistent cross-agent trails in browser history, session logs, and UI state, leaking sensitive relational metadata even when direct content is protected. RDL 18 - Approval Workflow Audit Trails as Com- prehensive Behavior Logs. Approval workflow audit trails that capture every decision request. evidence item, confi- dence score, and reviewer comment produce queryable logs that become high-value reconnaissance targets. In multi-agent workflows, these trails aggregate inter-agent reasoning ex- changes from multiple agents. The compliance requirement for full auditability directly conflicts with the security principle of minimizing logged sensitive data. Unlike singular-agent audit logs, multi-agent approval trails document the entire distributed decision-making architecture, providing adversaries with comprehensive blueprints for social engineering, fraud, or regulatory exploitation. RDL 19 - Approval Workflow Supporting Evidence Links as Data Aggregation Points. Approval workflow UIs that link directly to supporting evidence create data aggre- gation points where evidence may be more sensitive than the approval decision itself. Multi-agent workflows aggregate evidence from backend systems across multiple security do- mains without enforcing consistent access controls. creating indirect access paths that bypass normal role-based permis- sions. Users reviewing approvals can click evidence links to access raw data their roles should not permit. Unlike singular- agent evidence with consistent source controls, multi-agent evidence aggregation mixes data at different classification levels, making sensitivity assessment difficult and producing unintended access portals. RDL 110 - Interactive Refinement Iteration History as Decision Logic Disclosure. Collaborative refinement patterns that support multi-step iteration create complete histories ex- posing agent decision-making logic and quality thresholds. In multi-agent refinement pipelines. iteration histories capture inter-agent negotiations—how one agent evaluates another’s output, what triggers revisions, and what constitutes acceptable quality—forming comprehensive behavioral profiles. Attack- ers who analyze these histories can reverse-engineer decision boundaries and craft inputs to manipulate iteration outcomes or bypass quality gates. Unlike single-agent refinement that exposes only one agent’s logic, multi-agent histories docu- ment the full orchestration of specialization boundaries and acceptance criteria. RDL111 - Sensitive Data Exposure Through Alt Text and ARIA Labels. Accessibility features supporting screen readers inadvertently expose sensitive data extractable via scraping. Alt text and ARIA content in DOM are easily extracted where images displaying sensitive intelligence con- tain detailed descriptions invisible to unauthorized users. At- tackers exploit where ARIA labels for masked data contain full unmasked values for screen readers. collapsed sections have descriptive aria-describedby revealing information, and automated tools extract all attributes bypassing visual controls. Multi-agent contexts amplify because one agent’s accessible output becomes another’s input—alt text generated for acces- sibility may expose details when consumed downstream. 2) RDL 2 - Data Persistence and Caching: RDL21 - Session Persistence Serialization as Structured Data Exfil- tration. Session persistence that converts unstructured con- versation into structured, queryable formats transforms sen- sitive data into efficiently extractable records. Multi-agent serialized sessions contain structured representations of all agent interactions, decisions, data accesses, and reasoning traces—including metadata such as timestamps, identifiers, confidence scores, and lineage not visible in the UI but captured for restoration. Attackers who compromise session storage can run structured queries across thousands of sessions to extract targeted sensitive data at scale. Unlike singular- agent sessions or traditional task-specific storage, multi-agent persistence creates comprehensive snapshots including inter- agent negotiations and rejected reasoning branches, transform- ing conversation history into queryable databases that enable large-scale exfiltration. RDL 22 - Cached Responses Persisting Sensitive Data Beyond Session Lifetime. Performance caching of agent re- sponses creates persistent sensitive data copies in browser caches. CDN edge servers, and application layers that outlive the original session and may lack equivalent access controls. Multi-agent cached responses aggregate data from multiple agents—authentication tokens, customer PII, financial projec- tions, and proprietary algorithms—in single composite entries that persist beyond session termination and permission revoca- tions. The vulnerability is unique to multi-agent architectures because cache keys must capture agent combinations, and imperfect cache isolation can expose data from previous users’ sessions. Unlike singular-agent caching with clear ownership, multi-agent composite response caching requires reconciling security requirements across all contributing agents, complex- ity that frequently results in overly permissive caching of high- sensitivity outputs. RDL 23 - Undo Functionality Preserving Deleted Sensi- tive Data. Undo functionality maintains recoverable copies of deleted data in buffers that persist sensitive information users and agents believe has been removed. In multi-agent systems. reversing an action across multiple agents creates temporary states where sensitive data exists in undo buffers across mul- tiple systems while appearing deleted in the UI. This conflicts with data minimization regulations such as GDPR’s right to be forgotten. Multi-agent distributed undo creates coordination complexity for consistent retention policies and synchronized buffer clearing across agents, frequently resulting in buffers persisting longer or with weaker security than primary data stores. Unlike singular undo managing one state history, dis- tributed undo creates complex data lineage where ”deleted” information propagates through multiple systems’ recovery buffers. 3) RDL 3 - Streaming and Token-Level Leakage: RDL 31 - Streaming Response Token-by-Token Data Leak- age. Streaming response patterns that display agent output progressively create fine-grained leakage opportunities where sensitive information appears in UI buffers. network streams, and intermediate storage before post-processing redaction can apply. Multi-agent streaming handoffs create multiple sequen- tial exposure windows—each agent-to-agent stream introduces a new point where sensitive data appears in unprotected buffers. A model may begin streaming confidential content, recognize mid-generation that it is sensitive, and attempt redaction, but early tokens are already present in UI elements, browser memory, and network logs. Downstream agents in multi-agent pipelines may not detect that upstream content is sensitive until it is already in transit, making proactive redaction impossible across agent boundaries. RDL 33 - Streaming Tokenization Enabling Context Window Inference Attacks. Streaming reveals how content is tokenized (token boundaries. special tokens, embedding dimensions) enabling inference attacks on context windows. In multi-agent systems, attackers observing streaming patterns from multiple agents can infer context window sizes, token al- locations, and information prioritization. Large-context agents with streaming reveal differently than small-context agents, enabling attackers to map agent capabilities through streaming patterns. This data leakage about system architecture is unique to streaming as batch execution doesn’t reveal tokenization patterns. Multi-agent streaming from diverse agents creates attack surface for comprehensive system mapping through token boundary observation. RDL 34 - Streaming Output Length Correlation for Session Reconstruction. Streaming output lengths correlate with content sensitivity—very long streams indicate complex analysis. very short streams indicate error states or summary outputs. In multi-agent systems, attackers observing streaming lengths across sessions can reconstruct activity patterns with- out observing actual content. Long stream from security agent + short stream from business agent + medium stream from execution agent enables inference about decision types. Multi- agent streaming metadata (not content) enables statistical inference about agent activities and decision patterns creating data leakage at the metadata level. RDL 35 - Streaming State Updates in Multi-Agent Cy- cles Leaking Progressive State. When agents stream state updates during iterative cycles (updating code_history with each generated version). intermediate states appear in logs before final sanitization. In multi-agent cycling workflows where Agent A streams updates to Agent B which streams to Agent C, streaming handoffs create multiple exposure windows where sensitive intermediate states are visible. RDL 36 - Streaming Response Intermediate States as Information Leakage. Streaming responses in batched or load- balanced contexts reveal intermediate processing states. Partial responses show partial results enabling attackers to infer com- putation progress. Different agents’ streaming patterns reveal which agent is processing which request. RDL37 - Streaming Response Caching for Covert Data Exfiltration. Streaming responses cached for efficiency create opportunities for attackers exfiltrating data through cache side channels. Multi-agent systems caching streamed responses enable attackers querying caches to determine what streams were generated. potentially recovering sensitive information. A research agent streams response containing sensitive data; if response is cached, subsequent agents or attackers querying cache can recover data. The streaming caching attack differs from singular systems because multi-agent cache sharing cre- ates N-party visibility into streaming content. Attackers with cache access can determine which streaming queries occurred, potentially reconstructing sensitive information from cache metadata patterns. 4) RDL 4 - Search and Recall: RDL41 - Probabilistic Recall Through Conversation Search. Chat interface conversa- tion search creates probabilistic recall channels where queries for one topic surface sensitive information from semantically related contexts the user did not explicitly request. The vul- nerability is specific to multi-agent systems because search indexes span all agents’ histories without security boundaries. causing semantic similarity to cross-contaminate domains. For example, a search for financial terms may surface confidential HR or security content from other agents. Probabilistic and semantic matching treats the entire multi-agent history as a unified corpus without policy enforcement. Attackers can systematically probe with crafted queries designed to surface high-sensitivity content through semantic association, exploit- ing the absence of access-controlled search boundaries that traditional systems enforce. 5) RDL 5 - Attribution and Observability: RDL51 - Multi-Agent Attribution Logs as Organizational Intelligence. Attribution metadata logs that record which agents are used by which roles for which purposes expose organizational structure. security priorities, and operational workflows to attackers who compromise log storage. Multi-agent attribution creates richer intelligence than singular logs by revealing ecosystem-level patterns such as agent usage distributions across user roles map organizational hierarchy, identify high- privilege users, and expose which agents control critical func- tions. Unlike traditional logs that record feature access, multi- agent attribution documents agent specialization patterns that reveal strategic priorities and decision workflows. This makes attribution logs high-value targets for competitive espionage, social engineering, and targeted attacks. RDL 52 - Framework-Dependent Logging Enabling Data Leakage Through Debug Transparency. Different agent frame- works expose different implementation details in logs and debugging output. and multi-agent systems running multiple frameworks aggregate this telemetry into comprehensive sys- tem architecture disclosures. An attacker analyzing combined logs from multiple frameworks gains complete visibility into inter-agent coordination, data flows, and which agents ac- cess sensitive information—intelligence not obtainable from any single framework’s logs alone. Unlike singular-system debugging that reveals one component’s internals, multi- agent framework logging aggregates across all orchestration components, making combined logs more valuable than any individual framework’s output for attack planning and system reconstruction. RDL53 - Error Classification Pattern Leakage. Error classification distinguishes transient from permanent errors. In multi-agent monitoring, patterns of which agents experience which error types reveal system fragility. Attackers map error patterns to infrastructure, using repeated error induction to find weaknesses. RDL 54 - Latency Measurement Information Leakage. Post-execution monitoring tracks tool latency. In multi-agent systems, latency variations across agents reveal computational load, tool availability, and service quality. Attackers use la- tency timing to infer when systems are under load or tools unavailable, optimizing attack timing. 6) RDL 7 - Tool Invocation and Function Calling: RDL71 - Tool Invocation Logging as Side Channel for Context Leakage. Tools often log invocations for auditing and debugging. In multi-agent systems, comprehensive tool logging creates detailed records of which agents invoked which tools with what parameters. Attackers with log access gain information about agent behavior, task execution, and data flows. Tool parameter logging especially may leak sensitive data if parameters contain customer information, secrets, or business logic. RDL 72 - Function Calling JSON in Context Window as Leakage Vector. Function calling generates JSON visible in agent context windows and conversation history. This JSON includes parameter values, function names selected, and rea- soning about tool selection. In multi-agent systems sharing conversation history, function calling JSON persists across agent boundaries, potentially leaking sensitive information through tool parameters visible to multiple agents. RDL 73 - Tool Error Messages Containing Implementa- tion Details. Tools often return detailed error messages when invocations fail (SQL syntax errors, API authentication fail- ures, timeout details). These error messages leak implemen- tation details enabling attackers to understand tool internals for better exploitation. In multi-agent systems, error messages from tools used by one agent may be logged in conversation history visible to other agents, enabling reconnaissance across agent networks. RDL 74 - Tool Selection Reasoning as Cognitive State Leakage. When agents generate reasoning about why they selected specific tools, this reasoning is stored in memory and conversation history. Over time, reasoning patterns leak information about agent decision-making, training, and objec- tives. Multi-agent sharing of reasoning enables understanding of agent specialization and focus areas. RDL 75 - Function Description Context as Information Leakage. Function descriptions stored in plugin registries accessible through enumeration APIs leak organizational in- formation. Detailed descriptions of what functions do reveal capabilities, constraints, and operational patterns. RDL76 - Tool Invocation Audit Trail Poisoning. Exe- cution tracking logs all tool invocations for compliance. In multi-agent audit log systems, attackers compromise agents writing to logs to omit malicious invocations or inject fake benign invocations. Downstream compliance analysis finds no evidence of attacks. RDL 77 - Tool Success Rate Differential Leakage. Agents may track tool success rates. Different agents have different success rates with same tools due to parameter generation differences. Attackers observe success rate differ- entials to identify which agents generate better parameters, then compromise high-performing agents. RDL 78 - Parameter Values Leaking Through Action Logs and Traces. In multi-agent systems, action logs are ag- gregated centrally and sensitive parameters (API keys, account numbers, personally-identifiable information) leak through logs visible to multiple agents. The centralized log repository contains not just one agent’s parameters but all agents’ tool parameters, enabling comprehensive data exfiltration. RDL 79 - Action Accuracy Metrics Revealing Opera- tional Patterns. Detailed trajectory metrics captured during evaluation reveal operational patterns when aggregated across multi-agent evaluations. Metrics showing agent-specific tool preferences and confidence levels expose tool usage patterns attackers can exploit. RDL 710 - Tool Execution Log Aggregation as Multi- Agent Data Leakage Channel. Hybrid workflows aggregate tool execution logs across agents for coordination and auditing, concentrating sensitive data from all agents’ tool invocations in a unified trace. 7) RDL 9 - Multi-Agent Memory and State: RDL91 - Cross-Agent Reflection Memory Leakage in Multi-Agent Systems. Reflection memory stores become unauthorized con- duits in distributed architectures when multiple agents share infrastructure. Critic agents accumulating assessment data across evaluations create covert channels where sensitive data from one agent’s domain influences feedback for another. Probabilistic LLM recall makes leakage non-deterministic, obscuring detection through traditional audits. Unlike single- agent memory corruption affecting only that agent, multi- agent reflection creates systemic vulnerabilities across trust boundaries. RDL 92 - ReAct Reasoning Trace Persistence and Foren- sic Reconstruction Attacks. ReAct explicit reasoning traces persisted for debugging or compliance create comprehensive attack graphs exposing topology, tool dependencies, and de- cision logic. Multi-agent orchestrations document inter-agent communication patterns, coordination protocols, and hierar- chical structure, producing interconnected traces spanning components. Attackers accessing logs reconstruct architec- ture including agent-tool relationships, data flows, and failure points. Context exhaustion creates particular vulnerability as centralized persisted traces accumulate indefinitely outside memory management, providing complete history agents no longer possess. RDL 93 - Distributed Trace Cross-Tenant Correlation Leakage Through Timing Analysis. Distributed tracing with correlation IDs tracks requests across agent boundaries in multi-tenant deployments, enabling attackers to infer workflow patterns and business intelligence through timing metadata. Unlike single-agent isolated logging, distributed tracing cre- ates cross-tenant observability where metadata leaks concur- rent workflow information even when content is encrypted. RDL 94 - Shared Memory Blackboard State Reconstruc- tion via Access Pattern Analysis and False Sharing Tim- ing Attacks. Blackboard multi-agent systems using shared memory for implicit coordination enable attackers monitoring access patterns to reconstruct workflows and infer sensitive information without accessing content. False sharing timing attacks provide higher-resolution intelligence where competing agents’ memory lock contention reveals concurrent processing activity. Unlike single-agent private memory, blackboard ac- cess patterns become covert channels leaking workflows and data classifications across agent boundaries. RDL 95 - Multi-Agent Dashboard Correlation Leakage Through Simultaneous Agent Activity. Multi-agent monitoring dashboards displaying simultaneous activity across multiple agents create correlation leakage where patterns of which agents operate together reveal business workflows and organi- zational structure. Attackers analyzing dashboard patterns infer which agents collaborate, detecting specialized workflows and sensitive operations through correlation. 8) RDL 10 - Reasoning and CoT Traces: RDL101 - CoT trace leakage through memory queries. Chain-of-Thought reasoning traces stored in shared memory often contain the sensitive context information they analyzed. Agents querying memory for reasoning examples unintentionally retrieve sen- sitive data embedded in the CoT traces. RDL 102 - Intermediate step verbosity enabling data reconstruction. CoT’s explicit intermediate steps reveal the structure and content of intermediate computations. When these traces are logged or cached, attackers reconstruct sen- sitive inputs from step-by-step explanations (e.g., inferring actual customer data from steps like ”after filtering for age ¿ 18, I have 450 records”). RDL 103 - Reasoning-embedded secrets in shared traces. Agents sometimes document reasoning about sensitive oper- ations (e.g., ”I used API key [partial key shown] to verify credentials”). These reasoning traces, stored for multi-agent coordination, expose secrets through documentation. RDL104 - Cross-agent reasoning context leakage. When Agent A’s reasoning trace is input to Agent B’s reasoning process, all context that A considered (including sensitive data) flows to B. If B’s reasoning is then logged or stored, the original sensitive context gets replicated across systems. RDL 105 - Lookahead computation information leakage via tree state observation. ToT agents perform lookahead by exploring future branches speculatively. In multi-agent sys- tems, observing which branches are explored during lookahead can reveal future plans, strategies, or sensitive information. RDL 106 - Preserved Reasoning Path Context Leakage. High-quality reasoning paths preserved for explanation contain sensitive information from the original reasoning and occupy large context windows. In multi-agent systems where Agent A preserves paths containing sensitive data and downstream agents access those paths, data leakage occurs through pre- served context. Unlike volatile reasoning states, preserved paths persist creating long-lived leakage vectors. RDL 107 - Memory Consolidation Data Leakage Through Shared Context. Consolidation merges multiple in- dependent reasoning traces into a single consensus output stored for retrieval, and may inadvertently preserve sensitive information from original traces. In multi-agent systems shar- ing consolidated memory, all agents receive merged sensitive information from multiple sources. RDL 108 - Intermediate Reasoning Trace Probabilistic Recall Vulnerability. Self-Consistency maintains multiple rea- soning chains during generation; if these chains are partially preserved or logged, probabilistic recall mechanisms during multi-agent coordination might retrieve sensitive intermediate steps. In multi-agent systems, intermediate reasoning traces logged during execution become queryable through down- stream agents’ context retrieval, enabling sensitive data leak- age through probabilistic recall. RDL 109 - Quality Score Metadata Leakage Via Pre- served Paths. When reasoning paths are preserved with quality scores, the metadata reveals which paths contained useful in- formation. Over time, access patterns to high-quality preserved paths create side-channel leakage of organizational reasoning patterns. In multi-agent systems sharing quality metadata, attackers analyze access patterns across all agents’ preserved paths to infer sensitive organizational patterns. RDL 1010 - Failure Case Logging Data Leakage Through Difficulty Classification. Failed reasoning cases with low-confidence or non-convergent voting are typically logged with full reasoning traces for debugging. If these logs are accessed by downstream agents for learning from failures, sensitive information from failed reasoning paths leaks. In multi-agent learning-from-failure systems, one agent’s failed reasoning becomes training data for other agents. 9) RDL 11 - Multimodal and Input Processing: RDL111 - Multimodal Context Window Expansion Creat- ing Large-Scale Leakage Surfaces. Multimodal RAG agents process larger context windows combining text chunks, image captions, extracted tables, and audio transcripts, expanding information leakage channels proportionally. In multi-agent systems where synthesis agents achieve significantly larger context windows than text-only agents, sensitive information embedded in images, audio transcripts, and extracted data is exposed. RDL 112 - Vision Model Intermediate Representation Leakage. Vision models produce intermediate representations (image encodings, attention maps, feature maps) that could leak sensitive information about processed images. In multi- agent systems where vision model outputs feed downstream agents, intermediate representations might leak through model logs or be reconstructed from final outputs. RDL 113 - Audio Embedding Leakage Through Multi- modal Synthesis. Audio transcripts converted to embeddings for multimodal retrieval create privacy channels where em- beddings could reveal speaker identity, emotional tone, or background context through voice characteristics. In multi- agent audio RAG systems, these embeddings persist in vector stores accessible to all agents, creating leakage of sensitive audio metadata. RDL 114 - Chart Linearization Data Leakage Through Extracted Tables. Linearization of charts produces structured data extracting precise numerical values, creating permanent leakage vectors where sensitive financial, healthcare, or oper- ational data persists in machine-readable form. In multi-agent RAG pipelines storing linearized outputs, attackers accessing vector stores retrieve precise numerical data originally con- tained in protected images. RDL 115 - Multimodal Embedding Inversion for Con- tent Reconstruction. Embedding inversion attacks can recon- struct original images from stored embeddings. In multi- agent systems storing multimodal embeddings in shared vector databases, attackers can reconstruct sensitive visual content including medical imagery or confidential diagrams. 10) RDL 12 - Error Handling and Graceful Degrada- tion: RDL 121 - Error Message Logging as Data Leakage Channel. Error logging capturing full error context creates persistent data repositories containing sensitive information that appeared in error states, including user data, tool outputs, credentials, and API responses stored as debugging informa- tion. Multi-agent error aggregation means centralized error logs contain sensitive data from all agents, creating unified high-value leakage points through error message repositories. RDL 122 - Retry Attempt Logging Exposing Interme- diate States. Retry logic maintaining detailed logs of retry attempts exposes sensitive data through intermediate states captured during recovery. In multi-agent systems, each retry attempt logs full state including context, tool results, and agent assessments, accumulating sensitive information that persists indefinitely as debugging records. RDL 123 - Fallback Data Exposure Through Alternative Provider Logging. Fallback strategies routing to secondary providers create separate logging streams that may have weaker access controls or retention policies. In multi-agent systems where fallback chains route to less-monitored sec- ondary providers, sensitive data leaks through fallback logs with inconsistent security postures. RDL124 - Graceful Degradation State Logging Creating Capability Disclosure. Graceful degradation logging which ca- pabilities are disabled and why creates logs disclosing system architecture and capabilities. In multi-agent systems, degra- dation logs show which agents disabled which capabilities, creating intelligence about system configuration. Attackers analyzing degradation logs understand system architecture enabling targeted attacks exploiting knowledge of which ca- pabilities are security-critical. RDL 125 - Circuit Breaker State Change Logging as Infrastructure Reconnaissance. Circuit breaker logging state transitions (open/closed/half-open) with reasons reveals in- frastructure health patterns and failure causes. In multi-agent systems, circuit state logs show which endpoints fail and why, enabling attackers to understand system topology and failure patterns. Frequent circuit openings on specific endpoints re- veal which components are fragile or under attack, creating reconnaissance channels through error telemetry. 11) RDL 13 - Evaluation and Testing Leakage: RDL131 - Evaluation Metric Computation Leakage Through Logging Outputs. Evaluation pipelines log detailed metrics (accuracy, latency percentiles, cost breakdowns) that may reveal sensitive system information through detailed analysis patterns. In multi-agent systems, logged metrics from all evaluator agents create comprehensive system fingerprints exposing proprietary algorithms, user patterns, and cost struc- tures. RDL 132 - Evaluation Context Window Data Leakage Through Baseline Comparison. Baseline comparison agents load complete prior evaluation results into context for com- parison, potentially exposing historical sensitive data including prior user queries in test datasets. In multi-agent systems, these context windows leak information across agent boundaries as attackers access evaluation agent contexts containing raw historical evaluation data. RDL 133 - Test Dataset Exposure Through Evaluation Dashboards. Multi-agent evaluation dashboards displaying test case samples and evaluation details create data leakage vectors where attackers extract evaluation dataset patterns. Unlike operational dashboards with limited sample visibility, multi- agent evaluation dashboards aggregate samples across mul- tiple agents, creating comprehensive exposure of evaluation datasets. RDL 134 - Evaluation Artifact Storage Leakage. Eval- uation pipelines maintain artifacts (generated reports, de- tailed logs, intermediate calculations) in storage systems. In multi-agent evaluation with distributed artifact storage across evaluation agents, compromising any storage location leaks evaluation secrets. RDL 135 - Evaluation Log Leakage Through Detailed Error Messages. Evaluation scripts log comprehensive execu- tion information including test inputs, model outputs, inter- mediate reasoning steps, tool invocations, and error details. If logs are accessible, attackers gain understanding of evaluation logic enabling evasion. RDL 136 - Metric Output Fingerprinting for Evaluation Architecture Reconnaissance. Custom evaluation metrics pro- duce specific output formats enabling attackers to fingerprint which metrics are implemented and how. Learning metric implementations allows crafting inputs specifically designed to manipulate those implementations. RDL 137 - Evaluation Result Temporal Analysis for Behavior Pattern Inference. Evaluation results change over time as agents are updated or models are fine-tuned. Attackers analyzing temporal patterns of metric changes infer what changes were made and how agents are evolving, enabling targeted poisoning. RDL 138 - Cross-Validation Dataset Leakage Through Result Aggregation. Analyzing individual fold results in cross- validation could reveal which specific test cases or domains are harder, exposing dataset structure and enabling domain- specific attacks. RDL139 - Benchmark Result Leakage Through Ap- proval Logs. In multi-agent systems, approval logs record which agents approved which decisions with benchmark per- formance attached as justification, exposing agent capabili- ties and failure modes. Information about which benchmarks agents pass or fail enables attackers designing targeted attacks exploiting specific failure modes. 12) RDL 14 - Feedback and Testing: RDL141 - User Feedback Extraction as Agent Vulnerability Profiling. In multi- agent systems, user feedback is stored in accessible logs describing failure modes, enabling attackers analyzing stored feedback to identify systematic failures and craft targeted compromises. RDL 142 - A/B Test Result Leakage Enabling Agent Vulnerability Prediction. In multi-agent systems, A/B test results showing which agent variant performs better are stored and can be leaked, enabling attackers to identify which variants are more vulnerable to specific attacks. 13) RDL 15-EvaluationMetricExploitation: RDL151 - Exact Match Metric Exploitation Through Semantic Paraphrasing in Multi-Hop QA. Multi-hop QA benchmarks use Exact Match metrics expecting answers to match expected phrasing exactly. Adversaries inject instructions causing agents to produce answers matching evaluation expectations regardless of actual reasoning. RDL 152 - Joint Metric Evasion Through Selective Fact Injection. Joint metrics require both correct answer and correct supporting facts. Adversaries inject instructions generating correct answers with fabricated supporting facts optimized for joint metric evaluation. Multi-agent fact extraction and validation creates opportunities for fact injection bypassing individual agent checks through division of validation labor. RDL 153 - Pass@K Inconsistency Exploitation for Non- Deterministic Attacks. Attackers craft instructions activating only probabilistically, creating deliberate non-determinism that evades Pass@K detection. Multi-agent systems amplify this by aggregating pass@K across multiple agents, creating prob- abilistic attack surfaces invisible in single-agent metrics. RDL154 - Milestone Scoring Threshold Manipulation for Partial Credit Exploitation. Milestone-based scoring awards partial credit per milestone. Adversaries inject instructions targeting specific milestone achievement levels, enabling con- ditional execution at defined thresholds. 14) RDL 16 - Parameter and Configuration Leakage: RDL161 - Context Window Logging Leakage Through Parameter Tuning Trade-offs. In multi-agent systems, context windows tuned for performance create logging behavior where larger-context agents accumulate more sensitive information in audit logs. Attackers leverage context-tuning differences to identify which agents maintain comprehensive logs versus minimal logs, targeting large-context agents for data exfiltra- tion. RDL 162 - Token Consumption Pattern Leakage Through Cost-Optimized Tuning. Cost optimization creating differential model routing based on query complexity produces observable token consumption patterns revealing query sensi- tivity distributions. Attackers observing which queries trigger expensive model routing infer sensitive operational informa- tion. In multi-agent systems, cost-tuning creates differentiable token consumption patterns across agents, enabling leakage- through-cost-optimization attacks where operational context is inferred from tuned resource consumption. RDL 163 - Latency-Based Inference Through Parameter Optimization Fingerprinting. Specific tuned latency profiles create fingerprints enabling inference attacks revealing which configurations, models, and optimizations are deployed. In multi-agent systems, latency differences across agents tuned for different purposes create timing side-channels leaking information about query types. 15) RDL 17 - Prompt Injection and Few-Shot Attacks: RDL 171 - Demonstration Output Format Injection Enabling Parse Confusion. Few-shot demonstrations define expected output formats. Adversaries poison demonstrations with subtle format ambiguities embedding instructions disguised as for- mat components. Downstream agents parsing demonstration- defined format structures extract embedded instructions, prop- agating injections across agent boundaries as output interpre- tation conflation. RDL 172 - Generation Pattern Injection Through Biased Few-Shot Examples. Adversaries craft poisoned examples exhibiting suspicious confidence patterns in sensitive contexts. Agents learning from these examples generalize the confidence bias to similar contexts, generating overconfident malicious responses. RDL173 - Few-Shot Demonstration Contamination with Leaked Sensitive Data. Few-shot demonstrations used for prompt learning may contain sensitive data from prior demon- strations. Attackers craft prompts triggering probabilistic recall of sensitive demonstration data. 16) RDL 18 - Distributed Tracing: RDL181 - Dis- tributed Tracing Leakage Through Correlation IDs and Span Data. Distributed tracing systems create comprehensive work- flow leakage through trace ID correlation revealing complete operation chains and through stored span data containing inter- mediate results from each agent in the pipeline. Compromising tracing backends provides access to complete request traces showing all intermediate outputs and data flows across agents. RDL 182 - Response Schema Validation Log Side Chan- nels. Response validation logs which schemas fail. In multi- agent systems with heterogeneous schemas, patterns of which agents reject which response formats reveal information about agent configurations. Attackers use this to infer target agent types and customize attacks. 17) RDL 19 - Execution and Orchestration: RDL191 - Execution Path Disclosure in Error Messages and Progressive Disclosure. In multi-agent systems with shared error handling, one agent’s expanded error details disclose another agent’s execution paths. Multi-agent distributed error handling creates error accumulation where details propagate through multiple agents each adding context, ultimately creating detailed exe- cution traces visible through aggregated errors. RDL192 - Parameter Provenance Tracking Loss Creat- ing Attribution Gaps. In multi-agent handoff, provenance in- formation often serializes poorly, creating attribution amnesia where downstream agents cannot trace parameter origins. At- tackers poisoning early agent outputs can propagate malicious parameters downstream without visibility into their origin. 18) RDL 20 - Multi-Agent Reasoning: RDL201 - Or- chestrator Reasoning Quality Cascading Effects. Central or- chestrator agents reasoning about multi-agent coordination determine execution patterns that all worker agents follow. When orchestrators exhibit poor goal-alignment or embed in- jected logic in coordination decisions, all downstream workers execute the flawed or malicious reasoning. RDL 202 - Supervisor Delegation Reasoning Trans- parency Paradox. Supervisor agents reason about task dele- gation, and explicit transparency in supervisor reasoning can enable attacks. When supervisor reasoning explicitly reveals delegation patterns and trust assumptions, attackers exploit that transparency to manipulate delegation logic. RDL 203 - Multi-Agent Reasoning Coherence Valida- tion. No single agent can validate system-level reasoning coherence across multi-agent boundaries. An agent reasoning locally that a task is safe might be globally unsafe in system context, but no coherence validation occurs across agent boundaries. Attackers craft scenarios where individual agent reasoning is sound but system-level reasoning is incoherent, exploiting gaps no individual agent validates. RDL 204 - Consensus Reasoning Exploitation. When multiple agents reason about decisions and attempt consen- sus, low-informativeness reasoning enables injections hidden in non-contributory portions that other agents miss during consensus validation. 19) RDL 21 - Efficiency and Cost Attribution: RDL211 - Efficiency Logs as Information Leakage Vector. Efficiency monitoring logs token consumption, API calls, latency mea- surements, and cache hit rates containing aggregate informa- tion about operations and data processed. Attackers analyzing efficiency logs infer sensitive information through unusual token spikes, API call patterns, and cache metrics. RDL212 - Cost Attribution Metadata as Sensitive Infor- mation Leakage. Efficiency systems attribute costs to specific operations, tasks, and workflows, revealing what processing is expensive and therefore complex or potentially sensitive. Attackers analyzing cost patterns infer data sensitivity from operational cost differentials. RDL 213 - Cache Performance Metrics Revealing Data Sensitivity. Cache hit rates indicate data popularity and reuse. High cache hit rates for certain data suggest frequently- accessed sensitive information, enabling attackers to identify high-value targets. RDL 214 - Latency Anomaly Patterns Inferring Pay- load Size. Latency variations correlate with data processed, enabling attackers to infer processed data properties from operational timing. RDL 215 - Efficiency Dashboard Exposure of System Internals. Efficiency dashboards display metrics for monitor- ing, but expose operational details including agent identities, processing complexity, and cost breakdowns revealing system architecture. RDL 216 - Historical Efficiency Trend Analysis for Behavioral Inference. Efficiency metrics recorded over time reveal behavioral patterns such as batch processing schedules and resource constraints. Attackers analyzing efficiency trend history identify operational patterns exploitable for targeted timing attacks. RDL 217 - Budget Reallocation Patterns Revealing Op- erational Priorities. Efficiency systems dynamically reallocate budgets between agents based on workload, and budget re- allocation patterns reveal priorities where agents receiving increased budgets are processing important work. 20) RDL 22 - Infrastructure and Deployment: RDL221 - Message Queue Header Metadata Leakage Through Task Correlation. Message queue headers contain correlation IDs linking related messages across workflow stages. Attackers analyzing correlation patterns reconstruct complete user in- teraction sequences spanning multiple agents. RDL 222 - Vector Database Similarity Search Result Leakage Through Embedding Exposure. When vector similar- ity queries return embedding vectors themselves, attackers can potentially recover approximate original text through inverse embedding, leaking semantic information about the RAG corpus. RDL 223 - Prometheus Metrics Leakage Through Label Cardinality and Operational Exposure. Prometheus metrics expose sensitive information through high-cardinality labels enabling traffic analysis and behavior correlation, custom application metrics revealing operational details, and inter- agent communication patterns enabling temporal correlation of workflow orchestration logic. RDL 224 - API Gateway Access Log Correlation for User Activity Reconstruction. Gateway logs correlating all requests with timestamps, source, and destination enable at- tackers to reconstruct complete user workflows from correlated request chains. RDL225 - MLflow Artifact Metadata Leakage Through Versioning History. MLflow maintains complete version his- tory of all artifacts with metadata revealing who created ver- sions, when, and what changed. Attackers accessing MLflow infer security issues and vulnerabilities based on revision and reversion patterns. RDL 226 - Message Queue Dead-Letter Queue Content Leakage for Forensics. Dead-letter queues preserve failed messages including payloads, enabling attackers to read all failed message content revealing attempted operations, user context, and error details. RDL 227 - Centralized Logging Pipeline as Data Exfil- tration Vector. Multi-agent deployments centralize logs from all agents to unified logging systems. Attackers compromising centralized logging gain access to combined logs from all agents, enabling comprehensive data exfiltration. 21) RDL23 - Containerization Security: RDL231 - Shared Memory/Cache Side Channels in Containerized Agents. Containerized agents on shared physical hosts can leak data through CPU cache side channels. Attackers in container escaping scenarios can read memory contents from sibling containers. RDL 232 - Event Stream Retention Creating Persistent Data Leakage. Event brokers retain event history for replay. Agents publishing sensitive data to topics create durable data leakage exposure accessible to attackers with broker access. RDL 233 - Persistent Volume Mount Permission Es- calation Enabling Log Access. Agent containers mounting shared PersistentVolumes with overly permissive permissions can access other agents’ log outputs. Attackers compromising agents exploit this to exfiltrate sensitive data from other agents’ logs. RDL 234 - Sidecar Proxy Access Log Interception. Service mesh sidecars collect access logs for all inter-agent communication. Attackers compromising sidecar proxies inter- cept plaintext logs containing sensitive data or authentication tokens. RDL 235 - Init Container Environment Variable Leakage. Init containers receive environment variables with credentials and configuration. Attackers triggering crashes in init con- tainers can leak environment variables through error logs or container descriptions. RDL 236 - kubelet Port 10250 Unauthenticated Metrics Leakage. Kubelet’s metrics port exposes detailed system met- rics. Attackers with pod network access can query kubelet metrics revealing detailed resource utilization and operational patterns. RDL 237 - Etcd Database Backup Information Leakage. Kubernetes etcd database contains all cluster state including pod environment variables, ConfigMap contents, and Secret values. Attackers with etcd access exfiltrate all secrets and environment variables for all agents. 22) RDL 24 - Profiling and Optimization: RDL241 - Profiling Output Data Leakage Through Execution Traces. Detailed execution traces including memory contents and timing information could contain sensitive data processed by agents. Profiling data stored in repositories accessible to agents creates new leakage channels. RDL 242 - MLflow Artifact Registry as Data Exfiltration Channel. MLflow stores model versions, prompt artifacts, and evaluation datasets potentially containing sensitive information including business logic, tool schemas, or evaluation data metadata. RDL 243 - Baseline Comparison Leakage of Historical Behavior. Baseline performance metrics stored for regression detection include operational parameters revealing system be- havior and potentially exposing sensitive information about user request patterns. RDL 244 - Performance Optimization Logs as Side- Channel Leakage. Optimization processes generate logs show- ing configuration changes, parameter tuning attempts, and performance metrics that could reveal system capabilities, infrastructure constraints, and configuration details useful for attacks. 23) RDL 25 - Kubernetes Orchestration: RDL251 - Kubernetes Event Auditing Leaking Multi-Agent Orchestra- tion Logic. Kubernetes logs pod creation, scheduling, scaling, and failure events. In multi-agent deployments, audit logs re- veal which agents scale and fail together, indicating inter-agent dependencies and identifying critical agents whose failures trigger cascading restarts. Unlike singular deployments where audit logs reveal container lifecycle, multi-agent audit logs leak orchestration topology and dependency graphs through correlated scaling and failure patterns. 24) RDL 26 - GPU and Model Internals: RDL261 - GPU Memory Metrics Leakage Through Prometheus GPU Utilization per Model. Per-model GPU memory utilization metrics enable attackers to infer what models are loaded, batch sizes, and inference patterns. In multi-agent systems with multiple models deployed, GPU utilization patterns reveal which agents are active and enable temporal correlation be- tween agents. Unlike singular systems with one model, multi- agent GPU metrics enable orchestration reconstruction through utilization inference. RDL 262 - Container Logs and Stdout Leakage of Infer- ence Intermediates in Verbose Logging. Inference engines at verbose logging levels write inference requests, token genera- tion, and model outputs to logs captured by centralized Kuber- netes logging systems. In multi-agent deployments processing sensitive information, these logs leak inference intermediates across agent boundaries through shared logging infrastructure. Unlike singular deployments where logs remain service-local, multi-agent deployments centralize logs enabling cross-agent data leakage. RDL 263 - Queue Depth Metrics Enabling Inference Workload Reverse Engineering. Queue depth metrics reveal how many requests are pending inference. In multi-agent systems, statistical analysis of queue depth patterns across agents enables attackers to probabilistically reconstruct what requests are being made and to which agents. Unlike singular systems where queue metrics reveal single-service load, multi- agent queue analysis enables probabilistic reconstruction of distributed workflow patterns. RDL 264 - KV Cache Side-Channel Leakage Through Tensor Parallelism. Tensor parallelism distributes computation across GPUs with KV cache values transferred via inter-GPU communication without encryption in default configurations. An attacker with physical access to GPU connections can eavesdrop on KV cache transfers, extracting cached key-value activations from previous user conversations containing tool outputs, search results, and context. RDL 265 - Engine Binary Metadata Leakage. Engine binaries contain metadata including model architecture, layer configurations, and optimization decisions that enable model extraction attacks. In multi-agent systems where multiple agents execute engines built from the same base model, extracting one agent’s engine enables inferring all agents’ architectures through architectural similarity analysis. RDL266 - Quantization Artifacts as Probabilistic Leak- age Channels. INT8 quantization introduces systematic arti- facts in token probabilities where certain token ranges are quantized more aggressively. Attackers analyzing quantized model outputs can infer which activation ranges were exer- cised, revealing information about input content and domain. RDL 267 - GPU Memory Forensics via Engine Traces. Engine traces contain timing information, memory allocation sizes, and kernel invocations that reveal inference character- istics including tool execution, iteration counts, and relative timing of agent operations. RDL 268 - Calibration Dataset Artifacts in Quantization Statistics. INT8 quantization calibration produces statistics stored with engine metadata that leak information about the calibration dataset distribution, revealing the operational do- main of specialized agents. Attackers analyzing quantization statistics select targets based on revealed operational domains. 25) RDL 27 - Load Balancing: RDL271 - Load Bal- ancer Routing Decisions as Side Channels. Load balancer routing decisions create observable patterns enabling attackers to infer system load, relative capability differences between replicas, and sensitive patterns about request distribution. RDL 272 - Batching Window Timing as Information Side-Channel. Dynamic batching timeouts create predictable processing windows observable as latency patterns. Attackers can infer batch sizes and batch composition from response latencies. RDL 273 - Caching Hit/Miss Patterns as Side-Channel. Cache behavior creates observable latency differences re- vealing what cached data agents are accessing. High-latency responses indicate cache misses revealing what queries are new or uncommon. RDL 274 - Load Balancer Metrics Exposure Through Observability. Dynamic load balancers expose metrics about replica health and utilization through monitoring endpoints or observable latency patterns, enabling attackers to target specific replicas. RDL 275 - Auto-Scaling Event Timing as Attack Signal. Auto-scaling events are observable through network changes and response latencies, enabling attackers to observe when systems scale and identify replica capacities, configurations, and load management strategies. 26) RDL 28 - Planning Systems: RDL281 - Context Window Size as Leakage Capacity Indicator. In multi-agent systems, agents with larger context windows become targets for data extraction attacks because they preserve more reason- ing chain details. Attackers preferentially query large-context agents knowing they retain more sensitive reasoning detail. RDL 282 - Planning History Leakage Through Task Net- work Serialization. HTN planning systems generate complete task networks that may be serialized for debugging or inter- agent coordination, leaking sensitive information about system capabilities, tool access, and reasoning processes. In multi- agent hierarchical systems, Agent A generates task networks that Agent B must receive for coordination, creating multiple leakage points. RDL 283 - Method Library Reconnaissance Through Registry Access. Shared HTN method libraries contain com- plete method specifications including preconditions, decompo- sitions, effects, and constraints. An attacker with read access to method registries learns the complete planning space available to agents, enabling targeted attacks on specific methods. RDL 284 - Constraint Specification Leakage Revealing Resource Boundaries. HTN resource constraints reveal which resources are limited, exclusive, or protected, enabling at- tackers to identify high-value resources and trust boundaries. In multi-agent systems with visible constraint specifications, attackers learn resource allocation strategies. RDL 285 - State Abstraction Mappings Revealing Sensi- tive Information Structure. HTN state projection mechanisms map concrete state to abstract state, and these mappings reveal what information is considered sensitive or security-critical through inclusion and exclusion patterns. In multi-agent hier- archical systems where state projections flow between agents, visible projection definitions leak information classification. RDL 286 - Decomposition Pattern Analysis Leaking Planning Strategy. Frequent observation of how specific goals decompose reveals planning strategies and priorities, enabling attackers to infer system optimization targets and exploit known provider vulnerabilities. In multi-agent systems where decomposition patterns aggregate across agents, attackers learn system-wide planning biases. RDL 287 - Task Completion Logging Creating Execu- tion Timeline Leakage. HTN systems log task execution for monitoring and debugging, creating records of timing patterns, execution order, and failure patterns that enable reconstruction of system workflows through timeline analysis. In multi-agent systems with centralized logging, attackers analyzing logs learn complete execution timelines. 27) RDL 29 - Monte Carlo Tree Search (MCTS): RDL 291 - MCTS Tree as Implicit Planning Memory Leak. MCTS trees store complete state-action pairs, visit counts, and cumulative rewards encoding detailed planning history. In multi-agent context sharing, MCTS tree statistics become part of shared context, enabling attackers analyzing context windows to reverse-engineer planning decisions and discover strategically sensitive information. RDL292 - Simulation Trajectory as Probabilistic Recall Attack Surface. MCTS simulation traces represent rollout trajectories containing tool calls, parameter values, and state transitions for actions never actually executed. If simulation traces are logged, they become probabilistic recall surfaces where information about attempted-but-not-executed actions leaks through simulation history. RDL 293 - Value Network Confidence Scores as Infor- mation Disclosure. MCTS value networks output confidence scores revealing strategic assessments where high confidence in particular sequences discloses that those sequences appear valuable. In multi-agent systems sharing value network outputs for coordination, confidence estimates leak strategic intentions. RDL294 - Rollout Policy Behavior as Implicit Infor- mation Source. MCTS rollout policies encode domain prefer- ences through stochastic action selection, and analyzing rollout behavior reveals implicit strategy information. In multi-agent systems where rollout policies are shared or observable, policy behavior becomes an information leak channel disclosing strategically important planning assumptions. RDL 295 - Replanning Trajectory Leakage in Multi- Agent Logs. When agents replan, they generate search trees, intermediate path candidates, and heuristic evaluations rich with information about system state, available routes, and tool capabilities. In multi-agent systems where replanning logs are shared for coordination, these logs become searchable attack vectors enabling infrastructure topology reconstruction and tool API discovery. 28) RDL 30 - Monitoring and Callbacks: RDL301 - Discrepancy Leakage Through Monitoring Callbacks. During execution monitoring, agents broadcast discovered discrep- ancies (obstacles, failures, tool unavailability) to teammates, enumerating the exact state space regions being explored and tools attempted. 29) RDL 31 - Episodic Memory: RDL311 - Episodic Memory as Covert Data Exfiltration Mechanism. Episodic storage in external databases creates exfiltration channels where agents embed sensitive data in episodes stored in shared memory. Attackers with storage access directly exfiltrate col- lected data. RDL 312 - Embedding Vector Inference as Probabilistic Recall Leakage. Vector embeddings encode semantic infor- mation about episodes, enabling attackers inferring patterns in embedding spaces to reconstruct episode content without direct access. In multi-agent systems with shared episode vectors at scale, inference attacks reveal organization-wide operational patterns. RDL 313 - Consolidated Abstractions as Information Aggregation for Leakage. Consolidation summarizes raw episode details into abstractions that preserve enough informa- tion for reconstruction. Attackers accessing abstraction records infer underlying episode details. RDL 314 - Graph Relationship Traversal for Operational Pattern Reconstruction. Graph databases storing episode rela- tionships enable traversal reconstructing operational sequences and decision patterns. RDL315 - Deduplication Metadata as Statistical Infor- mation Leakage. Deduplication records which episodes are similar, enabling frequency analysis where attackers determine which operations are routine versus rare, reconstructing threat models. RDL 316 - Temperature/Sampling Artifacts in Episodic Recall Creating Information Channels. Retrieval uses topk from embedding similarity where exact scores depend on temperature and noise during embedding generation. Attack- ers analyzing variance in repeated retrievals infer underlying embedding structures and episode properties. 30) RDL 32 - Semantic Memory: RDL321 - Semantic Memory Context Window Leakage Through Retrieved Docu- ments. RAG systems include retrieved documents in context windows. Sensitive information in knowledge base documents leaks through context to agents and potentially to monitoring systems. RDL 322 - Knowledge Base Document Enumeration as Information Disclosure. Agents querying semantic memory reveal what documents exist through retrieval patterns. At- tackers enumerate knowledge base contents through systematic queries analyzing retrieval results. RDL 323 - Embedding Similarity Leakage Enabling Document Fingerprinting. Embeddings encode information about document content. Attackers can fingerprint documents by analyzing similarity patterns between documents and queries. RDL 324 - Temporal Metadata Leakage Revealing Doc- ument History. Knowledge base documents store creation, modification, and access timestamps. Temporal patterns leak information about system evolution and change frequency. RDL 325 - Knowledge Graph Structure as Information Leakage Channel. Knowledge graph relationships can be in- ferred from missing relationships. Absence of relationships is information, revealing sensitive relationship structures through systematic absence patterns. 31) RDL 33 - RAG Leakage: RDL331 - RAG Rele- vance Scores as Probabilistic Information Leakage. Semantic similarity scores indicate how relevant documents are. Attack- ers can infer document content by analyzing relevance scores across multiple queries. RDL 332 - Query Rewriting Logs Revealing Operational Intent. Query rewriting transforms user queries and logs of query transformations reveal system understanding of opera- tional intent, enabling attackers to understand agent reasoning processes. RDL 333 - Deduplication Artifact Leakage Revealing Content Similarity. Deduplication removes near-duplicates creating artifacts about which documents are similar. The deduplication decision itself leaks information about content relationships. RDL 334 - Compression Quality Validation Failures Creating Semantic Information Leakage. When compression validators fail silently, hallucinated summaries propagate to downstream agents and enter episodic memory as validated knowledge, making false information more credible than the original source material. In multi-agent compression pipelines, validation status metadata causes downstream agents to treat hallucinated content as highly credible. RDL 335 - Semantic-to-Working Augmentation Informa- tion Leakage During Knowledge Distillation. When seman- tic knowledge is generalized from specific working memory episodes involving multiple agents’ context, the distillation process may include identifying information about specific agent instances, user behaviors, or tool chains. Semantic memory becomes a privacy breach channel where information from episodic memory leaks through distillation, affecting all agents accessing semantic memory. 32) RDL 34 - Utility Functions and Explanations: RDL341 - Progressive Disclosure UI Information Leakage in Multi-Agent Chat Interfaces. Progressive disclosure hides technical details in expandable views, creating information leakage where sensitive context appears only in sections users rarely inspect. In multi-agent chat interfaces, each agent’s dis- closure layers operate independently and may contain sensitive data from other agents’ execution context. Unlike singular agent chat interfaces with consolidated disclosure, multi-agent interfaces distribute sensitive data across multiple agents’ ex- pandable sections, creating multiple information leak vectors. RDL 342 - Chat Interface Utility Parameter Disclosure Through Progressive Disclosure. Chat interfaces showing ex- panded technical views can expose utility function parameters (weights, outcome valuations) agents use for decisions, en- abling attackers to infer optimization targets and craft targeted attacks. RDL 343 - Streaming Decision Rationale Leakage Dur- ing Utility Explanation. When agents explain decisions through streaming, streaming explanation can leak utility calculations, outcome estimates, and probability assumptions before agents can redact sensitive utility details. RDL 344 - Error Message Outcome Utility Disclosure. When tools fail, error messages can disclose what outcomes the agent expected and their utility values. Aggregated error messages across multi-agent system reveal utility expectations creating a broader attack surface. RDL 345 - Inference Trace Leakage in Explanation Gen- eration. Generating explanations from inference traces reveals rule firing sequences and intermediate facts that may disclose sensitive information. In multi-agent systems where traces propagate through workflows, sensitive intermediate facts may leak through explanation channels. RDL 346 - Working Memory Content Exposure Through Shared Persistence. Working memory stores current facts and intermediate conclusions. In multi-agent systems with shared persistent working memory, sensitive facts stored in working memory leak across agent boundaries through shared persis- tence. RDL 347 - Rule Condition Inference for Reconstruction. Detailed rules with many conditions can leak information about protected concepts through their logical structure. In multi-agent systems where rules are shared and inspectable, rule structure reveals protected information through logical inference. 33) RDL 35 - Reinforcement Learning and Policy: RDL 351 - Gradient-Based Model Inversion Attacks on Learned Policies. Learning-based policies trained via gradi- ent descent can be inverted revealing training data through gradient analysis. Multi-agent systems with shared gradients enable attackers analyzing aggregated gradients to reconstruct all agents’ training data including sensitive information. RDL 352 - Value Function Reconstruction Revealing Training Context. Learned value functions encode knowledge of state values learned from training experiences, enabling attackers querying value functions to reconstruct which states and contexts appeared in training. In multi-agent systems with shared value networks, reconstruction reveals all agents’ training data. RDL 353 - Policy Behavior Querying Reconstructing Training Data. Black-box policy queries revealing action prob- abilities enable attackers to reconstruct training data distribu- tions as agents trained on specific scenarios show distinctive behavior patterns. RDL 354 - Experience Replay Buffer Side-Channel At- tacks. DRL systems store experiences in replay buffers whose management (sampling distributions, eviction order) creates side channels revealing buffer contents. Large shared buffers in multi-agent systems leak aggregated training data. RDL 355 - Reward Function Reverse Engineering. Learned agents’ behaviors reveal reward function structure. Attackers reverse-engineer reward functions discovering sen- sitive optimization objectives, and multi-agent systems opti- mizing shared rewards leak function structure faster through multiple agent behaviors. RDL 356 - Learning Curve Analysis as Information Leakage. Training curves leak information about training data and processes. Multi-agent training curves aggregated across agents reveal statistical patterns of combined training. RDL357 - Context Window Expansion Data Leakage in Hybrid Agent Coordination. Hybrid multi-agent systems expand context windows to maintain shared paradigm state across agent boundaries, concentrating sensitive data from multiple agents in shared context windows vulnerable to leakage through probabilistic token generation. 34) RDL36 - Multi-Agent Coordination: RDL361 - Multi-Agent Conversation Trace Leakage Through Shared History. Conversation history maintained for hybrid cooper- ation across agents accumulates sensitive data from multiple agents’ interactions, and probabilistic recall in token genera- tion may output sensitive data from shared history. RDL 362 - Knowledge Graph Edge Weight Leakage via Embedding Inference. Knowledge graphs store weighted relationships enabling inference of sensitive associations. Em- beddings trained on knowledge graphs may leak relationship weights through probabilistic generation. C. Agent identity, provenance, and economic/resource attack surface Agentic systems lack mature identity, provenance, and cost-control mechanisms, creating distinct security challenges highlighted in recent position papers and the NIST RFI pro- cess. Unique dimensions: • Weak or absent agent identity: Agents often operate using shared API keys or generic service accounts, blurring the mapping from human principals to agent instances and policies. • Economic abuse and resource hijacking: Costs tied directly to tokens, vector queries, and API calls enable denial- of-wallet attacks or covert resource exfiltration through expen- sive plans, unnecessary tool calls, or plugin-driven ”resource leeching.” Unlike traditional microservices with stable, explicitly managed identities and predictable resource profiles, agentic systems bind identities and costs loosely to learned behavior, giving attackers greater leverage over both. 1) RIP1 - Multi-Agent UI & Dashboard Attacks: RIP 11 - Multi-Agent Dashboard Identity Spoofing Through Attribution Gaps. Multi-agent dashboard UIs without clear identity indicators (persistent avatars, color coding, crypto- graphic signatures) enable impersonation attacks exploiting differentiated user trust in specialized agent roles. Attackers in- ject content appearing from trusted high-authority agents when actually from compromised low-authority agents. Unlike sin- gular agent systems, multi-agent dashboards must authenticate agent identity at the UI layer, and the lack of cryptographic verification allows compromised RAG pipelines or malicious plugins to inject styled content bypassing skepticism applied to unknown sources. RIP 12 - Multi-Agent Dashboard Attribution Forensics Failures Preventing Attack Investigation. Multi-agent dash- board UIs without detailed attribution logs for which agent generated which content based on which inputs create foren- sics blind spots. When malicious decisions are discovered, the lack of fine-grained attribution makes determining which agent in the pipeline was compromised impossible. This multi-agent vulnerability requires tracing causality across multiple agent interactions—far more complex than singular agent forensics. Attackers can compromise low-visibility agents knowing ma- licious outputs will be difficult to trace through the pipeline. RIP 13 - Multi-Agent Dashboard Real-Time Cost Attri- bution Failures. Multi-agent dashboard UIs displaying outputs from multiple agents without real-time cost attribution for each agent’s contributions create economic accountability gaps. Users cannot identify when compromised or misconfigured agents consume excessive resources, enabling economic at- tacks hiding in aggregate reporting. Multi-agent dashboards require real-time per-agent cost breakdowns enabling identi- fication and prevention of resource abuse before significant costs accumulate. RIP 14 - GroupChat Speaker Attribution Enabling Social Engineering Through Identity Confusion. GroupChat message history attributes messages to sender identity, but if identity is manipulable through prompt injection, attackers can appear as other agents. Messages appearing from Security Reviewer but originating from compromised Research Agent enable manipulation through false attribution. Singular agents don’t communicate; GroupChat’s attribution creates social engineer- ing surfaces unique to multi-agent peer communication. 2) RIP 2 - Approval & Workflow Attacks: RIP21 - Approval Workflow Provenance Tracking Failures Enabling Decision Attribution Attacks. Approval workflow UIs lacking cryptographic provenance trails create accountability gaps in sequential multi-agent pipelines where each participant assumes previous agents performed due diligence. Without cryptographic proof of which agent generated analysis, at- tackers inject malicious logic at any pipeline stage. The UI’s structured sections without cryptographic signatures allow modifying recommendations or injecting fabricated analysis that subsequent approvers unknowingly validate. RIP 22 - Approval Workflow Confidence Aggregation Attacks Through Selective Agent Compromise. Approval workflow UIs displaying aggregated confidence scores from multiple agents without per-agent breakdowns enable attacks where compromising high-weight agents manipulates final displays. In weighted multi-agent systems, attackers focus on high-weight agents to maximize impact while the UI conceals that a compromised agent dominated the aggregated score. Unlike singular agent systems, multi-agent confidence aggregation lets one high-weight agent override skepticism from multiple lower-weight agents. RIP 23 - Approval Workflow Decision Provenance Tam- pering Through UI State Manipulation. Approval workflow interfaces storing decision provenance in client-side state or weakly authenticated logs enable attackers to tamper with records obscuring malicious approvals. In multi-agent systems, workflows involve complex state including which agents pro- vided analysis, confidence scores, and human decisions. If stored without cryptographic signatures, attackers can modify records shifting accountability. Unlike singular agent systems with simple approval records, multi-agent workflows require tamper-evident logging across complex provenance graphs. RIP 24 - Approval Workflow Multi-Stage Provenance Gaps in Sequential Agent Reviews. Approval workflow UIs displaying final recommendations from multi-stage agent pipelines without cryptographic provenance for intermediate stages create accountability gaps. A recommendation result- ing from multiple sequential agents’ assessments shows only the final output, allowing early-stage compromise to poison analysis. This multi-agent sequential vulnerability amplifies attack opportunities—compromising any agent affects final recommendations, and the UI’s abstraction into simplified ”AI Recommendation” prevents integrity verification of intermedi- ate stages. RIP 25 - Approval Decision Attribution Ambiguity. HITL approval workflows create ambiguous attribution when multiple actors contribute to final decisions. Multi-agent con- texts amplify this because approval chains span multiple agents with different policies—attribution fragments across agent boundaries. Mitigation requires explicit responsibility assignment (users selecting decision authority), modification logging with reasons, batch approval granularity tracking, timeout default provenance, and decision chain reconstruction maintaining complete lineage from initial recommendation through modifications to execution. 3) RIP 3 - Command Palette & UI Attacks: RIP31 - Command Palette Cost Visibility Gaps Enabling Economic Denial-of-Service. Command palettes suggesting AI-powered actions without displaying resource costs enable denial-of- service attacks where context manipulation recommends ex- pensive operations users execute without cost awareness. In multi-agent systems, suggestions may trigger workflows in- volving multiple expensive agents, and aggregate costs exceed user expectations by orders of magnitude. Attackers poison context sources causing proactive suggestions for resource- intensive operations, and the UI’s lack of real-time cost esti- mation enables consuming API quotas without user awareness. RIP32 - Command Palette Agent Identity Confusion in Suggestion Attribution. Command palettes displaying sugges- tions without clearly indicating which agent produced them create attribution confusion. In multi-agent systems, users develop differentiated trust based on track records. An attacker compromising the low-trust productivity agent can inject dan- gerous commands appearing from high-trust security agents. This multi-agent-specific vulnerability differs from singular systems with uniform suggestion trust. RIP 33 - Command Palette Rate Limiting Bypass Through Agent Identity Switching. Rate limiting at the user level rather than per-agent tracking enables attackers to bypass limits by switching which agent executes commands. In multi- agent systems, the same command may be executable by multiple specialized agents with different resource profiles. If rate limiting tracks total commands without accounting for which agents execute them and their costs, attackers exhaust resources by repeatedly invoking expensive agents. Unlike singular systems where user-level limiting controls one agent, multi-agent systems require agent-aware rate limiting accounting for relative costs. 4) RIP 4 - Multi-Agent Coordination Attacks: RIP41 - Reflection-Amplified Resource Exhaustion in Multi-Agent Swarms. Multi-agent systems employing reflection patterns enable exponential resource consumption through reflection cascades exploiting inter-agent feedback loops. Unlike single- agent reflection (3-5x cost multiplication), multi-agent archi- tectures create compound chains where Agent A’s reflected output triggers Agent B’s reflection, creating N-factorial ex- plosion. Agents cannot distinguish legitimate reflection needs from upstream invalidation signals. Detection proves difficult because individual agent metrics appear normal while aggre- gate costs explode. RIP 42 - Orchestrator Resource Exhaustion via Co- ordinator Overload in Centralized Multi-Agent Hierarchies. Centralized orchestration patterns use single manager agents coordinating specialized workers, creating bottlenecks where coordination traffic scales non-linearly with concurrent work- flow count. Attackers flood orchestrators with coordination requests exploiting state management overhead for workflow state tracking, delegation decisions, result aggregation, and failure recovery. Unlike direct agent resource exhaustion, or- chestrator attacks target coordination infrastructure that scales with active workflow count unlike stateless workers. RIP 43 - Auction Manipulation via Strategic Bidding Exploitation and Coalition Formation in Market-Based Co- ordination. Multi-agent systems using auction-based resource allocation create economic attack surfaces where agents com- pete through bidding. Attackers manipulate outcomes through strategic bidding, Sybil coalition formation, or timing exploita- tion to monopolize resources or deny service. Coalition forma- tion amplifies impact—multiple colluding agents coordinate bids manipulating price discovery, winning 80% of auctions at suppressed prices. RIP 44 - Message Flood Denial-of-Service via Broadcast Amplification in Event-Driven Multi-Agent Networks. Event- driven multi-agent systems using publish-subscribe patterns enable one-to-many communication creating broadcast ampli- fication vulnerabilities. Attackers exploit this creating message flood denial-of-service—publishing one malicious event trig- gering cascading message generation across subscribers, over- whelming queues. Unlike single-agent systems with bounded messaging, multi-agent event-driven architectures enable one malicious publisher affecting M subscribers simultaneously. 5) RIP 5 - Framework-Specific Attacks: RIP51 - Framework-EnforcedIdentityModelsCreatingCross- FrameworkImpersonationOpportunities.Different frameworks implement agent identity differently (LangChain’s implicit identity through execution context, LangGraph’s node identity bound to graph structure, AutoGen’s agent instance names, CrewAI’s role-based identity, Semantic Kernel’s plugin identity). Multi-agent systems integrating across frameworks create identity translation gaps. Attackers exploit these gaps performing cross-framework impersonation. Unlike singular systems with consistent identity model, multi-agent systems require translating identity across framework-specific models, and N frameworks create N(N-1) translation semantics likely containing gaps. RIP 52 - Framework-Dependent Cost Attribution En- abling Economic Denial-of-Service. Different frameworks have different resource consumption patterns. Multi-agent sys- tems mixing frameworks make total cost attribution impos- sible. Attackers poison context causing expensive operations in cost-opaque frameworks enabling denial-of-wallet attacks. Unlike singular systems with clear cost models, multi-agent systems introduce framework-relative costs making compre- hensive accounting impossible, and multi-agent cost attribution requires tracking costs per operation per framework. RIP 53 - AutoGen Conversational Identity Confusion Without Cryptographic Binding. AutoGen agents identify themselves through message content without cryptographic signing, creating identity spoofing opportunities. Other agents trusting identity claims can be manipulated by compromised agents impersonating trusted specialists. Singular systems don’t have peer identity verification; AutoGen’s conversation- based identity enables spoofing unique to multi-agent dialogue. RIP 54 - CrewAI Hierarchical Role Attribution Enabling Impersonation. CrewAI agents defined by roles can be im- personated if role assignments lack cryptographic verification. Attackers compromising orchestrators can dynamically assign malicious agents to trusted roles. Role-based trust becomes ex- ploitable when role assignment is unverified. Singular systems have single trust models; CrewAI’s role-based specialization creates impersonation surfaces where malicious agents can assume legitimate roles. RIP 55 - AutoGen Conversation Resumption Cost Am- plification. AutoGen conversations can be resumed, and re- suming expensive conversations in multiple sessions ampli- fies costs. Attackers poison conversation history with expen- sive operations ensuring resumption in future sessions incurs charges repeatedly. Singular agent conversation resumption is isolated; AutoGen’s multi-agent resumption affects all agents amplifying costs across boundaries. RIP56 - Semantic Kernel Context Window Token Con- sumption in Multi-Agent Orchestration. Semantic Kernel con- structs orchestrator prompts describing all available plugins and functions. Multi-agent systems with hundreds of plugins create massive context consumption. Attackers poison plugin registries with verbose descriptions forcing expensive context management. Shared plugin registry means context overhead multiplies with agent count—100 agents with 500-plugin reg- istry each consume orchestrator tokens 100x; singular agents don’t scale context consumption. 6) RIP 6 - Tool & Plugin Attacks: RIP61 - Eco- nomic Attack Surface Expansion Through Multi-Agent Tool Chaining. Chat interfaces displaying tool invocations without real-time cost accumulation enable economic attacks where malicious context causes agents to chain expensive tool calls. In multi-agent architectures, a single task triggers cascading tool calls across multiple specialized agents. Attackers poison context amplifying resource consumption across all agents, while progressive disclosure hides cumulative cost. This multi- agent tool chaining amplifies costs multiplicatively rather than additively. RIP 62 - Tool Invocation Cost Attribution Gaps in Multi- Agent Memory Sharing. ConversationBufferMemory enables agents to maintain conversation history, but tool invocation costs are attributed to the first agent that queried the tool, not agents benefiting from cached results. In multi-agent sys- tems sharing conversation history, subsequent agents re-using memory-cached results benefit without bearing costs, enabling economic attacks. Singular agents don’t share memory; multi- agent sharing enables free-rider resource exhaustion. RIP 63 - Tool Registry Enumeration Enabling Economic Reconnaissance. LangChain agents discover tools through tool registries, enabling attackers to enumerate available tools iden- tifying expensive operations. Multi-agent shared tool registries provide comprehensive enumeration of all agents’ available tools; singular agents expose only one agent’s tools. RIP64 - Tool Execution Cost Opacity in Agent Scratch- pad. Agent scratchpad logging tool invocations doesn’t typi- cally display per-tool costs, creating opacity where agents can- not recognize when specific tools become expensive. Attackers poison tool selections causing agents to invoke expensive variants without cost visibility. Multi-agent tool recommen- dation systems enable attackers poisoning context to suggest expensive tool variants across all agents. RIP 65 - Multi-Agent Tool Cost Attribution Complexity Enabling Economic Denial-of-Service. AutoGen and CrewAI coordinate multiple agents each invoking tools with different costs, but UI cost tracking often shows aggregate costs with- out per-agent breakdowns. Attackers poison context causing expensive tool invocation across multiple agents hide costs in aggregate reporting. Singular agent tool costs are directly attributable; multi-agent costs distribute across agents enabling attribution ambiguity attackers exploit. RIP 66 - Plugin Execution Identity Ambiguity in Multi- Agent Delegation. Plugins execute with kernel-provided ser- vices rather than explicit agent identity. When Plugin A delegates to Plugin B through orchestration, Plugin B’s identity to downstream services is the kernel’s identity, not Plugin A’s. Multi-plugin chains lose identity tracking with each hop— Plugin A→B→C chain ends with only kernel identity visible to final service; singular plugin chains maintain single identity. RIP 67 - Plugin Registry Economic Cost Attribution Failures. Plugin discovery and registration consume compute resources for manifest parsing, schema validation, and function description processing. Attackers poison plugin registries with expensive plugins consuming resources attributed to all agents. Registry-level cost poisoning affects all agents with no attribu- tion mechanism; singular plugins have clear cost ownership. RIP 68 - Tool Invocation Attribution Spoofing. Tools log which agent invoked them for auditing and monitoring. In multi-agent systems, attackers can manipulate invocation attribution making tool invocations appear from trusted agents rather than compromised agents. Singular agents don’t have attribution spoofing risk; multi-agent systems enable attackers spoofing agent identity in tool invocations. RIP 69 - Tool Access Privilege Inheritance Through Agent Composition. Multi-agent hierarchies may grant su- pervisor agents all privileges needed to delegate to workers, but workers inherit these privileges through delegation. If Supervisor has database admin credentials to delegate tasks, Worker agents may retain or exploit those credentials. Singular agents with explicit privilege scoping don’t have privilege composition issues; multi-agent delegation chains enable priv- ilege accumulation through delegation context inheritance. RIP 610 - Tool Execution Cost Exploitation Through Distributed Invocation. Tools have costs (API calls, compute resources, storage operations). Multi-agent systems enable at- tackers distributing malicious tool invocations across multiple agents, making costs appear distributed and harder to detect. Distributing expensive invocations across many agents ob- scures patterns through distribution. Single agent with exces- sive tool costs shows obvious pattern; multi-agent distributed cost enables stealthy resource exhaustion. RIP 611 - Tool Access Token Leakage Through Agent Communication. Tools require authentication tokens or API keys. In multi-agent systems, these credentials may be passed between agents through function calls or context. Attackers monitoring inter-agent communication can capture credentials leaked in parameters or conversation history. Single agent with local token storage doesn’t have inter-agent credential leakage; multi-agent credential sharing enables token theft. RIP 612 - Tool Failure Attribution Confusion. When tools fail, logs show which agent invoked them. In multi- agent systems with shared tools, attackers deliberately fail tools they don’t control by having other agents invoke them with bad parameters, blaming innocent agents. Singular tool failures are attributed to one agent; multi-agent shared tools enable attackers attributing failures to wrong agents through coordinated invocation. RIP613 - Profiling Tool Chain of Custody Loss. Pro- filing tools and their outputs pass through multiple systems (collection → storage → analysis). Multi-agent systems with agents independently trusting shared profiling data create 1-to- N identity compromise where fraudulent profiling affects all agents simultaneously. RIP 614 - Tool Execution Authority Delegation in Hy- brid Workflows. Hybrid architectures delegate tool execution across paradigms. Attackers exploit delegation chains gaining execution authority through paradigm composition. Single tool authorization is direct; hybrid multi-agent tool execution del- egation creates transitive authority where compromising any paradigm in chain grants execution authority to all downstream agents. RIP 615 - Tool Access Privilege Inference and Esca- lation. Tool audit logs show which agents invoked which tools. In multi-agent systems, attackers analyze logs to infer privilege levels—agents invoking payment tools have higher privilege. They then compromise lower-privilege agents to relay requests to higher-privilege agents, escalating privileges through agent chains. Singular agents have fixed privilege; multi-agent privilege inference enables attackers to climb privilege chains through agent-to-agent escalation. 7) RIP 7 - Cost & Economic Denial-of-Service Attacks: RIP71 - Resource Attribution Ambiguity in Statistical Anal- ysis Agents. Statistical evaluation agents performing signif- icance testing, confidence interval calculation, and complex statistical analysis consume substantial compute. In multi- agent evaluation, cost attribution is ambiguous. This ambiguity enables attackers requesting expensive analyses knowing costs are difficult to track. Multi-agent attribution gaps enable sta- tistical analysis resource exhaustion undetected. RIP 72 - Performance Claim Verification Costs Creating Economic Attack Surface. Validating whether performance improvements are real requires statistical tests and independent validation. In multi-agent systems, verifying every agent’s claimed performance becomes economically expensive (N agents × M benchmarks × K repetitions). Attackers exploit this by making plausible performance claims assuming insufficient verification. Single-agent verification scales linearly; multi- agent systems create O(N²) verification requirements. RIP 73 - Policy Compliance Metric Evasion in ST- WebAgentBench. ST-WebAgentBench’s Completion Under Policies (CuP) metric rewards policy-compliant task comple- tion. Adversaries inject instructions that appear to respect policies while subtly violating them. Multi-agent policy en- forcement gets circumvented through metric evasion. Single- agent CuP evaluation applies one policy check; multi-agent systems where policy-checking agents inform execution agents enable policy evasion through enforcement division. RIP 74 - Resource Allocation Attribution in Multi-Agent Execution. In multi-agent systems, which agent’s resource consumption should be charged? Cost attribution ambiguity creates economic attack surfaces where attackers trigger ex- pensive operations in agent chains, distributing costs across multiple agents making accountability unclear. RIP 75 - Cost Attribution Misalignment for Incentive Manipulation. Efficiency incentive systems reward agents for cost reduction (agents meeting efficiency targets get priority access). Attackers manipulate cost attribution making ineffi- cient operations appear cost-effective. Single-agent incentive gaming affects that agent; multi-agent systems with shared incentive structures enable coordinated gaming where multiple agents collectively optimize toward poisoned efficiency met- rics. RIP 76 - Token Price Volatility Exploitation. Efficiency systems track and exploit token price variations across providers. Attackers manipulate price tracking causing agents to select providers based on false prices. Single-agent provider selection affects local routing; multi-agent systems with cen- tralized provider selection enable attackers poisoning price data affecting all agents’ routing. RIP 77 - Deprecation/Migration Pressure as Resource Constraint Attack. Efficiency systems plan migrations away from expensive components (deprecating old models, consol- idating APIs). Attackers exploit migration pressure creating urgent resource constraints. Single-agent migration pressure affects that agent’s transition; multi-agent systems with co- ordinated migrations enable attackers exploiting system-wide deprecation deadlines to force rapid adoption of poisoned optimizations. RIP78 - Cost Attribution Gaming via Resource Request Padding. Kubernetes billing systems charge by resource re- quests (CPU, memory) not actual usage. Single-agent padding affects one agent’s billing; multi-agent coordinated padding across N agents creates systematic cost tracking failures where billing systems miscalculate true consumption. RIP 79 - Resource Quota Exhaustion Attacks Against Co-Tenant Agents. Namespace resource quotas limit aggre- gate resource consumption. Attackers compromise agents to consume quota space, starving co-tenant agents. Multi-tenant multi-agent clusters enable economic denial-of-service where compromising quota-aware agents allows exhausting shared quotas, disabling all agents in namespace. RIP 710 - Session Affinity Creating Pseudo-Identities. IP hash creates persistent session identities tied to client IPs. Attackers could spoof client IPs creating false session identities or hijacking existing sessions. Stateless systems don’t create pseudo-identities; session affinity creates pseudo- session-identities exploitable through IP-layer attacks. RIP 711 - Cost Attribution Gaps in Load-Balanced Systems. Horizontal scaling makes cost attribution com- plex—which replica incurred which costs? This attribution ambiguity enables economic attacks where costs are misat- tributed. Single agent cost tracking is straightforward; load- balanced systems create cost attribution opacity. RIP 712 - Provenance gaps in multi-step reasoning chains. When multiple agents contribute to a reasoning chain, it becomes unclear who contributed which steps, making backdoor detection and trust assessment impossible. Agent A’s reasoning could be sound while Agent B’s poisoned reasoning hides within the same trace. Single-agent reasoning has clear provenance; multi-agent accumulated reasoning chains have mixed provenance, making it impossible to assess which agent contributed potentially compromised reasoning. RIP 713 - Economic exploitation through reasoning am- plification. An attacker agent generates expensive reasoning (many CoT steps, expensive tool calls in reasoning) that looks justified in its local context. Costs accumulate across all agents amplifying the original attack. Single agent cost attacks affect one system; multi-agent systems where expensive reasoning spreads across agents create multiplicative cost amplification. RIP 714 - Search tree branch provenance spoofing across agent network. Without proper attribution of which agent generated candidate thoughts in the shared tree, attackers can forge the origin of branches to appear as though they came from trusted agents. Multi-agent reasoning requires tracking provenance across agents; single-agent ToT doesn’t require this provenance tracking. RIP 715 - Preserved Path Provenance Spoofing. When Self-Consistency paths are preserved for later retrieval, the provenance becomes a spoofing target. Attackers can inject paths into preserved repositories with falsified provenance claims. In multi-agent systems with shared preserved path repositories, provenance spoofing enables trust exploitation. Single-agent path retrieval from hardcoded sources remains identity-bound; multi-agent shared repositories with weak provenance enable identity spoofing affecting all agents query- ing the repository. RIP716 - Identity Verification Gaps in Multi-Agent Workflow Coordination. Self-Consistency voting produces consensus-based decisions; if identity of voting contributors is not tracked, Agent B receiving Agent A’s voting results cannot verify which agents contributed. This creates identity verification gaps where multi-agent workflow coordination lacks audit trails of decision contributors. Single-agent voting affects one model’s output; multi-agent voting with identity gaps enables coordinated attacks without attributable agents. RIP 717 - Resource Attribution Poisoning in Cost Al- location. HTN planning tracks resource usage (CPU time, memory, tool API calls) for cost allocation and optimiza- tion. Attackers poison resource attribution causing incorrect cost assignment. Single-agent tracking affects one agent’s optimization; multi-agent shared tracking enables poisoned attribution affecting all agents’ resource-aware planning. RIP718 - Economic Incentive Manipulation in Multi- Agent Allocation. When HTN planning includes economic in- centives (budget allocation, cost optimization, pricing signals), attackers manipulate incentive signals. In multi-agent systems with shared economic models, poisoned incentives distort resource allocation across all agents. Single-agent incentives affect one agent’s preferences; multi-agent shared economic models enable attackers distorting all agents’ resource alloca- tion decisions. RIP 719 - Identity Spoofing in Inter-Agent Decomposi- tion Handoff. When Agent A produces decompositions that Agent B executes, Agent B must identify A’s decompositions as legitimate. In multi-agent hierarchical systems, decompo- sition handoffs lack identity verification, enabling attackers injecting false decompositions appearing from higher-authority agents. Single-agent decomposition is internal; multi-agent inter-agent decomposition handoff requires identity verifica- tion absent in many implementations. RIP 720 - Parallelization Overhead as Resource Attack Surface. MCTS parallelization (running multiple simulations on multiple cores) has synchronization overhead. Attackers can force pathological parallelization scenarios causing MCTS to use resources inefficiently. Single-agent parallelization over- head affects one agent; multi-agent systems with coordinated parallelization can be forced into pathological synchronization patterns creating multiplicative overhead. RIP 721 - Replanning Resource Exhaustion Attacks. Attackers trigger excessive replanning cycles in multi-agent systems by injecting false discrepancy signals (fake obstacles, phantom tool failures). Single agents suffer limited replanning overhead; multi-agent systems with shared planning infrastruc- ture can be collectively denial-of-serviced by distributed false signals affecting team-level planning capacity. RIP 722 - Episode Attribution Spoofing Through Anony- mous Consolidation. Consolidation creates abstracted sum- maries losing original episode sources. Attackers cannot be traced to poisoned episodes if consolidation anonymizes them. Single-agent episode accountability remains within one agent; multi-agent consolidated knowledge loses source tracking, enabling anonymous attack propagation where agents cannot identify poisoning origins. RIP 723 - Fake Experience Injection as False Provenance Attacks. Attackers craft episodes with timestamps suggesting they originate from trusted veteran agents. Single agents have one identity; multi-agent systems enable attackers spoofing veteran agent identities injecting false-provenance episodes trusted by teams. RIP 724 - Resource Exhaustion Through Episode Dedu- plication Overhead. Deduplication comparing each new episode against existing episodes incurs similarity computation costs. Attackers create thousands of nearly-identical poisoned episodes forcing deduplication to compute similarities, ex- hausting computational resources. Single-agent deduplication compares against local episodes; multi-agent shared deduplica- tion compares against millions of shared episodes enabling at- tackers exhausting organization-wide computational resources. RIP725 - Economic Attack Through Storage Expansion. Episodic storage in cloud systems charges per stored vectors. Attackers accumulate massive poisoned episodes driving up storage costs. Single agents’ storage footprint remains man- ageable; multi-agent organizations with fleet-wide episodic ac- cumulation compound storage expansion, enabling economic attacks driving infrastructure costs. RIP 726 - Consolidation Compute Cost Attack. Peri- odic consolidation requires expensive LLM calls to abstract episodes. Attackers force consolidation of massive poisoned episode sets increasing compute costs. Single-agent consol- idation has bounded cost; multi-agent fleet consolidation of poisoned episodes across millions enables economic denial- of-service through consolidation computation. RIP727 - Embedding Cache Eviction Exploitation for Computational Amplification. Embedding cache eviction poli- cies evict least-recently used embeddings. Attackers craft queries causing frequent cache misses triggering recomputa- tion. Shared cache thrashing affects all agents’ query latency simultaneously creating system-wide performance degrada- tion. RIP 728 - Budget Allocation Negotiation as Autho- rization Confusion. When coordinator agents allocate token budgets to worker agents, budget allocation becomes an au- thorization signal—Agent A requesting large output budget implicitly claims need for extensive output. In multi-agent systems, attackers compromise coordinator agents to grant malicious agents excessive budgets, implicitly signaling oper- ations are authorized. Singular agents with fixed budgets have no authorization signals; multi-agent budget negotiation treats allocation decisions as implicit authorization, enabling attack surfaces absent in single-agent systems. RIP 729 - Utility Function Attribution Spoofing in Multi- Agent Dashboards. Dashboards displaying which utility func- tions drive which agents’ decisions can be spoofed so mali- cious utility functions appear attributed to legitimate agents. Single agent’s utilities clearly attributable; multi-agent dash- board attribution makes spoofing plausible because users can- not verify utility assignment cryptographically. RIP 730 - Resource Consumption Through Expensive Utility Calculations. Some utility functions (e.g., Monte Carlo sampling thousands of outcomes, solving complex optimiza- tion) are computationally expensive. In multi-agent systems, attackers can trigger expensive utility calculations across multiple agents simultaneously through coordinated requests causing resource exhaustion. Expensive calculations on single agent consume its resources; expensive calculations triggered on multiple agents enable denial-of-wallet attacks multiplying resource costs across the system. RIP 731 - Economic Utility Optimization Incentivizing Resource Wastage. When utility functions include cost as objective with easily-manipulated cost estimates, agents might optimize toward operations with false low-cost estimates con- suming actual expensive resources. In multi-agent systems, Agent A’s poisoned cost estimates affect downstream agents’ tool selections causing system-wide resource misallocation. Single agent misallocating resources limits to its budget; multi-agent coordination around poisoned cost utilities enables cascading resource wastage across agents. RIP 732 - Persistent Volume Claim Ownership Ambigu- ity Enabling Multi-Agent Contamination. Persistent volumes mounted by multiple agent pods lack ownership tagging beyond Kubernetes metadata. If multiple agents mount the same PVC and one agent is compromised, it can modify contents affecting all agents. Unlike singular deployments with exclusive storage, multi-agent shared storage creates contamination vectors where compromise propagates through shared claims to all dependent agents. RIP 733 - Cost-Based Agent Selection Vulnerability. Fleet Command enables selecting agents for inference based on cost. An attacker can gradually migrate tool execution toward cheaper agents by injecting cost assumptions favoring them, concentrating tool execution on potentially less-secure hardware. Single-agent selection is direct; multi-agent cost- based routing creates economic attack surfaces where cost as- sumptions become instruction-injection vectors systematically biasing tool execution toward compromised infrastructure. RIP 734 - Resource hijacking through reasoning- guided consumption. An agent’s reasoning documents why resource-intensive operations are necessary. A single attacker- compromised agent can hijack resources across the entire system through distributed reasoning. Single-agent resource hijacking is limited to that agent’s allocation; multi-agent systems enable attackers to distribute resource hijacking across all agents through shared reasoning patterns. RIP 735 - Multi-Connector Authentication Ambiguity Creating Credential Provenance Confusion. ETL pipelines authenticate to sources with credentials, but multi-agent sys- tems sharing credentials create ambiguity about which agent accessed which source. When agents use shared credentials, database logs cannot attribute operations to specific agents, preventing attribution during incidents and compliance au- dits. Compromised agents extracting sensitive data appear indistinguishable from legitimate agents using shared cre- dentials, complicating incident response. Credential cascades compound this across multi-hop agent chains, and multi-agent shared credentials eliminate fine-grained provenance required for security auditing. RIP 736 - Incremental Update Provenance Gaps from Coarse State File Granularity. ETL incremental updates track progress in state files with coarse timestamps, creating prove- nance gaps where no record tracks which specific documents were processed. Multi-agent shared state files compound is- sues: when agents use the same file, the timestamp advances without agent-level provenance, making compliance queries impossible without reprocessing source systems. Single-agent timestamp-only tracking has bounded gaps; multi-agent shared state creates fleet-wide provenance gaps preventing document- level audit trails. 8) RIP 8 - Resilience & Error Handling Attacks: RIP 81 - Streaming Response Resource Consumption Opac- ity in Multi-Agent Workflows. Streaming patterns displaying agent output while hiding background processing by multiple agents create opacity enabling attackers to hide expensive operations during user distraction. In multi-agent systems, streaming one agent’s response may simultaneously trigger background processing by other agents analyzing streamed content. Attackers inject instructions causing expensive back- ground processing during streaming windows. Unlike singular agent streaming representing one model’s output, multi-agent streaming decouples response generation from background analysis. RIP 82 - Retry Budget Attribution Across Multi-Agent Boundaries. Error handling implementing retry budgets lacks clear attribution for who consumed retries. In multi-agent systems with shared retry pools, attackers exhaust retry bud- gets consuming credits belonging to legitimate operations. Attribution gaps prevent determining which agent consumed retries, enabling denial-of-service through retry exhaustion. RIP 83 - Fallback Provider Cost Attribution Failures. Fallback strategies routing to secondary providers create cost differences. In multi-agent systems, cost attribution for fall- back invocation is ambiguous. Attribution gaps hide economic attacks where fallback abuse inflates provider costs. RIP 84 - Circuit Breaker Resource Consumption Attri- bution Gaps. Circuit breaker protection overhead (monitoring failures, managing state transitions, timeout logic) consumes resources but attribution is unclear. In multi-agent systems with centralized infrastructure, resource costs distribute across all agents creating attribution opacity. Attackers exploiting circuit breaker overhead cannot be identified enabling dis- tributed denial-of-service through abuse disguised as shared infrastructure costs. RIP 85 - Graceful Degradation Cost Imbalance Attribu- tion. Graceful degradation enables operations at reduced capa- bility/cost or increased cost depending on degradation choice. In multi-agent systems, degradation decisions affecting cost are attributed ambiguously. Attribution gaps enable attackers deliberately triggering degradation to expensive alternatives appearing as cost-justified necessity. RIP 86 - Streaming Attribution Spoofing Through Pro- gressive Identity Claims. Streaming responses enable identity spoofing where early tokens claim identity while later tokens execute malicious operations before verification. In multi- agent systems displaying streaming with identity attribution, attackers craft streams where attributed identity doesn’t match origin. Early tokens establish trust; later tokens exploit that trust executing operations. Multi-agent dashboards enable at- tacks where identity spoofing succeeds because early tokens establish trust before complete stream enables verification. RIP 87 - Streaming Resource Consumption Opacity En- abling Economic Denial-of-Service. Streaming responses hide real-time resource consumption, making economic attacks dif- ficult to detect. Multi-agent systems with background stream- ing processing create resource consumption opacity. Attackers poison context causing expensive background processing dur- ing user interactions, inflating resource consumption without cost awareness. 9) RIP 9 - Multimodal Attacks: RIP91 - Multimodal Content Attribution Spoofing Through Vision Model Outputs. In multi-agent systems, agents’ identities are partially estab- lished through output modalities. Attackers create false content claiming different modalities. Text content attribution remains within language domain; multimodal content attribution en- ables spoofing across modality boundaries. RIP 92 - Vision Model Resource Exhaustion Through Multimodal DDoS. Vision models consume substantial re- sources (GPUs, bandwidth, memory). In multi-agent systems where multiple specialized agents invoke vision models, at- tackers trigger resource exhaustion through coordinated mul- timodal requests. Single-agent resource exhaustion affects that agent; multi-agent systems with shared vision model backends create amplification where N agents’ requests compete for shared resources. RIP 93 - Audio Processing Resource Exploitation Through Long-Duration Content. Whisper transcription con- sumes resources proportional to audio duration. In multi-agent audio RAG systems, attackers submit extremely long audio recordings, exhausting resources across all audio processing agents. Single-agent audio processing creates bounded re- source consumption; multi-agent systems with shared Whisper deployment create resource pools enabling attackers to monop- olize shared infrastructure. RIP 94 - Embedding Vector Store Resource Amplifica- tion Through Multimodal Scale. Multimodal RAG systems storing embeddings for text, images, audio, and extracted structures create vector stores 3-5x larger than text-only systems. Larger vector stores consume more GPU memory, increase query latency, and create more attack surface for poisoning. Attackers exploit scale expansion causing denial-of- service through similarity search overload. Text vector stores remain at manageable scale; multimodal systems’ expanded storage creates infrastructure strain exploitable through coor- dinated agent queries. 10) RIP 10 - Reasoning & Evaluation Attacks: RIP101 - Evaluation Cost Attribution Failures Enabling Economic DoS. Evaluation pipelines consuming significant resources in- cur costs. In multi-agent evaluation systems where cost track- ing is per-agent, attackers can cause specific evaluator agents to consume excessive resources. Without clear attribution, economic attacks hide in aggregate evaluation costs. Multi- agent distribution enables cost obfuscation unlike singular evaluation with direct mapping. RIP 102 - Evaluation Agent Identity Spoofing in De- cision Displays. Evaluation dashboards display recommenda- tions from evaluation agents. In multi-agent systems without cryptographic identity binding, attackers can spoof evaluation agent identity. Compromised agents producing malicious rec- ommendations can appear to originate from trusted agents. Singular agents with trivial identity; multi-agent systems with distinct trust levels become susceptible to impersonation. RIP 103 - Evaluation Artifact Provenance Opacity En- abling False Attribution. Evaluation artifacts (reports, metrics, recommendations) lack cryptographic provenance. In multi- agent evaluation systems with complex artifact generation, it’s unclear which agent generated final artifacts. Attackers modify evaluation artifacts appearing as legitimate outputs. Singular artifact generation has clear authorship; multi-agent artifact composition obscures provenance enabling attacks tampering with results appearing authorized. RIP 104 - Economic Denial-of-Service Through Exces- sive Evaluation Cycles. Evaluation pipelines can be triggered excessively (continuous evaluation on model updates, triggered by monitoring anomalies, developer-initiated evaluation). In multi-agent evaluation systems, attackers can cause continuous evaluation cycles by triggering false alarms. Unlike singular evaluation with bounded trigger points, multi-agent evalua- tion’s distributed triggers create multiplicative cost explosion. RIP105 - Evaluation Result Attribution Spoofing. Eval- uation results posted as PR comments with agent identity attri- bution. If comment generation doesn’t cryptographically sign results, attackers could forge evaluation comments showing passing metrics for failing code. Multi-agent evaluation with multiple contributors enables spoofing results from trusted agents while compromising less-trusted ones. RIP 106 - Evaluation Framework Resource Consumption as Attack Vector. Running evaluation pipelines consumes computational resources. Attackers could deliberately design agents requiring expensive evaluation (using large test datasets, invoking expensive metrics) forcing timeouts or cost escala- tion. Multi-agent evaluation where agents’ computational cost varies enables attackers concentrating expensive evaluation on specific agents causing infrastructure overload. RIP 107 - Benchmark Attribution Spoofing Creating False Provenance. Benchmark results are attributed to specific agents/versions. Attackers spoof attribution causing malicious agent improvements to be credited to honest agents. Single- agent attribution affects one reputation; multi-agent systems with transitive reputation relationships enable false attribution creating cascading trust exploitation. RIP108 - Quality Score Identity Confusion in Multi- Agent Assessment. RASC assigns quality scores to reasoning paths. In multi-agent systems, if Agent A’s quality assess- ment is applied to Agent B’s paths without re-evaluation, identity confusion occurs. Downstream agents cannot distin- guish whose assessment was applied, enabling transitive trust exploitation. Single-agent quality assessment remains locally- attributed; multi-agent assessment propagation creates identity confusion where attribution gets lost across agent boundaries. RIP 109 - Sampling Budget Resource Allocation as Eco- nomic Attack Surface. Cost-accuracy trade-offs use sampling budget as primary economic variable. In multi-agent systems with shared resource pools, controlling sampling budget al- location across agents enables economic attacks. Attacker- controlled agents can claim excessive sampling budget starving other agents, or force resource-starved agents to use low budgets. Single-agent resource consumption remains isolated; multi-agent shared pools enable economic attacks where one agent’s resource hoarding affects others. RIP 1010 - Difficulty Classification Economic Exploita- tion. Difficulty-adaptive sampling allocates resources based on problem classification. Attackers gaming difficulty classi- fication (claiming hard problems are easy) reduce sampling budgets. In multi-agent systems with shared classifications, one agent’s gaming affects resource allocation for all agents. Single-agent gaming affects one agent’s budget; multi-agent shared classifications enable systematic economic exploitation. RIP 1011 - MCTS Computational Budget as Re- source Exhaustion Vector. MCTS planning is computationally expensive—high-quality planning requires millions of simu- lations. Attackers force agents to perform MCTS planning for expensive problems (high branching factor, deep trees), exhausting computational budgets. In multi-agent systems competing for shared resources, one agent’s expensive MCTS planning starves other agents. Single-agent exhaustion affects one agent; multi-agent resource contention amplifies exhaus- tion through shared resource pools enabling starvation of multiple agents. RIP 1012 - Multi-Pattern Cost Amplification Through ReAct-ReflectionInteractionExploitation.Adversaries weaponize pattern composition targeting systems combining ReAct’s iterative action loops with Reflection’s self-critique cycles, creating multiplicative cost explosions exceeding individual pattern overhead. This attack exploits architectural blind spots where pattern interactions go unmonitored and cost controls apply to patterns in isolation. ReAct agents typically consume 5-10 LLM calls per task; adding reflection to each reasoning step multiplies this: 10 ReAct iterations × 3 reflection cycles per iteration = 30 LLM calls minimum. The unique multi-agent dimension emerges when different agents employ different patterns in coordinated workflows, creating multiplicative costs across pattern boundaries. RIP 1013 - Evaluation Authority Delegation to Com- promised Agents. Continuous evaluation implements qual- ity gates enforcing thresholds blocking merges if metrics regress. If evaluation agents are compromised, attackers can approve malicious changes or block legitimate ones. Multi- agent evaluation systems with multiple specialized evaluation agents delegate authority to multiple agents enabling attackers compromising one agent to control specific evaluation aspects. RIP 1014 - Offline vs. Online Evaluation Distribution Gap Exploitation. Offline benchmarks differ substantially from online evaluation on live websites. Attackers craft instructions specific to offline benchmark artifacts that don’t activate in online evaluation but appear successful offline. Single-agent offline evaluation faces one offline-online gap; multi-agent systems where evaluation results guide development decisions get misled by benchmark-specific compromises affecting all coordinated agents. RIP 1015 - Behavioral Consistency Non-Determinism Exploitation in Pass@K Evaluation. Pass@K measures reli- ability across trials. Attackers craft instructions with proba- bilistic activation designed to succeed inconsistently, appear- ing as natural non-determinism. Multi-agent systems with aggregated pass@K metrics across specialized agents get compromised through coordinated probabilistic instruction ac- tivation. Single-agent non-determinism is model stochasticity; multi-agent systems’ aggregated pass@K enables adversary- controlled probabilistic instruction activation appearing as natural variance. RIP 1016 - Few-Shot Metric Interpretation Poisoning in Analytics Agents. Analytics agents learn metric interpre- tation patterns from few-shot examples. Poisoned examples showing ”metric X indicates Y condition” teach incorrect metric semantics. Multi-agent evaluation with poisoned metric examples in analytics demonstrations propagates to all agents consuming analytics, creating distributed decision poisoning through metric interpretation examples. 11) RIP11 - Vector Store & RAG Attacks: RIP111 - Cost-Per-Query Parameter as Economic Abuse Vector. ”Cost per query” as optimization metric determines acceptable oper- ational expense. In multi-agent systems, cost-tuning param- eters determine acceptable expense. Attackers exploit cost- tuning by crafting queries designed to exceed cost budgets (resource exhaustion), or crafting queries appearing cheap but incurring hidden costs. RIP 112 - Resource Consumption Accounting as Eco- nomic Attack Vector. Efficiency systems track resource con- sumption per agent for billing/chargeback purposes. Attackers exploit accounting mechanisms—consuming resources while avoiding attribution, or triggering inflated accounting causing resource exhaustion for other agents. Single-agent accounting affects that agent’s budget; multi-agent systems with shared resource pools enable attackers exhausting system-wide re- sources through coordinated consumption evading accounting. RIP 113 - Knowledge Base Source Attribution Loss Through Multi-Agent Processing. Knowledge base documents track source but multi-agent processing loses provenance. Multi-hop agent chains progressively lose source attribution enabling instruction laundering where origin becomes untrace- able. RIP114 - Knowledge Base Replication Cost as Eco- nomic Attack Surface. Replicating semantic memory across geographic regions incurs storage and network costs. Attack- ers craft documents causing excessive replication increasing infrastructure costs. Distributed agent deployments requiring shared knowledge base replication enable attackers increasing operational costs through replication amplification. RIP 115 - Indexing Infrastructure Cost Exploitation. Cre- ating and maintaining semantic indices incurs computation costs. Attackers craft high-cardinality documents requiring expensive indexing. Shared indexing infrastructure enables attackers increasing collective indexing costs through single document injection. RIP 116 - Vector Database Partition Escaping for Cross- Agent Identity Confusion. Milvus partition keys define isola- tion boundaries. If partition keys derive from agent identity (partitionkey=agentname), attackers could craft queries es- caping partitions accessing other agents’ isolated data. Shared vector database with partition isolation creates identity bound- aries. Multi-agent partitioned databases enable attackers es- caping agent identity boundaries, accessing data belonging to other agents, creating cross-agent identity fraud where attacker impersonates agent identity to access resources. RIP 117 - Vector Database Query Load Amplification. Agents querying shared vector databases amplify retrieval loads. Attackers trigger episodes designed to be retrieved by all agents simultaneously (using common triggers), creating query load spikes. Single-agent queries generate isolated load; co- ordinated multi-agent retrieval enables amplified load attacks where synchronized poisoned episode retrieval overwhelming storage infrastructure. RIP 118 - Knowledge Graph Ownership and Autho- rization Ambiguity. Knowledge graphs shared across multi- agent hybrids create ambiguity about who owns graph data and who authorizes modifications. Attackers exploit authoriza- tion gaps injecting relationships appearing authorized because graph access controls don’t clearly establish component-level authorization. Single graph access is clear; multi-agent shared graphs where multiple agents contribute create authorization ambiguity. RIP 119 - Embedding API Endpoint Provenance Con- fusion in Multi-Provider Systems. Multi-agent RAG systems using API-compatible embedding endpoints from multiple providers create provenance confusion where agents cannot reliably determine which actual model produced embeddings. This enables endpoint switching attacks where attackers mod- ify environment variables to redirect embedding requests to malicious endpoints while maintaining API compatibility. In multi-agent systems, endpoint provenance confusion com- pounds when different agents use different providers but store embeddings in shared vector databases without model provenance tracking. Single-agent systems with hardcoded endpoints have clear provenance; multi-agent systems using environment-based endpoint configuration and shared vector stores create provenance ambiguity enabling attackers to inject malicious embeddings indistinguishable from legitimate ones. RIP 1110 - Model Version Registry Ambiguity in Multi- Provider Embedding Deployments. Multi-agent systems using embeddings from multiple providers lack centralized model version registries tracking which embedding model versions are deployed for which agents, creating version ambiguity that attackers exploit through semantic drift attacks. When agents unknowingly operate with different embedding model versions, attackers craft documents that embed favorably in older versions but unfavorably in newer ones. The lack of version provenance in vector stores prevents detecting version- based attacks. Single-agent deployments using one model version have consistent semantic spaces; multi-agent systems create version heterogeneity enabling undetectable version- based attacks. RIP 1111 - Shared Vector Database API Key Prove- nance Loss Across Multi-Agent Deployments. Multi-agent systems often configure single shared API keys across all agents, creating provenance loss where database access logs cannot distinguish which agent performed which operations. This enables attribution evasion where a compromised agent’s malicious queries appear indistinguishable from legitimate operations. The provenance loss extends to data ownership, complicating compliance requirements where specific agent- data mappings are required. Single-agent systems using one API key have implicit one-to-one agent-credential mapping; multi-agent systems with shared credentials create many-to- one relationships eliminating fine-grained provenance required for security auditing. RIP 1112 - Vector Database Selection Provider Lock- In Obscuring Data Provenance Across Migrations. Multi- agent systems selecting different vector databases create data provenance challenges when migrating between providers because vendor-specific features and data formats prevent clean provenance tracking. Migrations strip audit metadata, enabling data laundering attacks where attackers inject ma- licious vectors knowing migration will remove attribution. Multi-agent systems using heterogeneous databases compound this across agent boundaries, and provider-specific distance metric implementations create additional provenance gaps. Single-agent single-database deployments maintain consistent provenance; multi-agent multi-database deployments create provenance fragmentation where migrations eliminate cross- database tracking required for compliance. RIP 1113 - ETL Source Attribution Loss Through Meta- data Normalization and Field Stripping. ETL transformation pipelines normalize heterogeneous metadata into consistent schemas, stripping source-specific provenance. Multi-agent systems cannot determine fine-grained provenance: an agent retrieving a normalized document cannot identify which table, schema version, or user created it. Normalization creates conflicts when multiple sources contain identical documents, making retrieval unable to determine authoritative sources. Multi-agent systems with differing normalization rules com- pound confusion when agents preserve different fields. Single- agent ETL with source-specific schemas maintains detailed provenance; multi-agent aggressive normalization strips attri- bution fields, preventing fine-grained document tracing. 12) RIP 12 - Memory & Session Attacks: RIP121 - Session Persistence Context Pollution Enabling Long-Duration Resource Drain. Context awareness features persisting agent conversation history create memory spaces attackers pollute with resource-intensive instructions activated in future ses- sions. In multi-agent systems with shared session context, poisoned context causes multiple agents to perform expensive operations every session resumption. Unlike singular agent systems where context resets or remains confined to one model, multi-agent context persistence creates distributed state exploitable as a cross-agent infection vector. RIP 122 - Checkpoint Attribution Ambiguity in Multi- Agent Workflows. LangGraph checkpoints maintain execution state but may lack clear attribution about which agent made specific state changes. In multi-agent workflows, determining which agent was responsible becomes difficult when check- points are corrupted. Without checkpointing explicitly tracking agent contributions per field, forensics cannot pinpoint which agent injected malicious state. Single-agent checkpoints have clear ownership; multi-agent checkpoints aggregate multiple state mutations creating complex provenance graphs. RIP 123 - Economic Cycling Attack via Unbounded Iteration Loops. LangGraph’s explicit cycle support enables iterative refinement, but unbounded iteration without cost controls enables denial-of-wallet attacks. Attackers craft in- puts causing conditional edges to loop excessively. In multi- agent cycling, each cycle iteration invokes multiple specialized agents multiplying costs. Single-agent loops consume one model’s tokens; multi-agent cycles multiply costs across agent specializations enabling exponential resource exhaustion. RIP 124 - Memory Persistence Cost Overhead En- abling Denial-of-Wallet. ConversationBufferMemory persists full conversation history to databases, and extended con- versations accumulate storage costs. Attackers extend con- versations artificially or with expensive tool results, inflat- ing storage costs. Multi-agent conversation sharing amplifies this—expensive tools from multiple agents accumulate in shared memory, and storage costs grow faster than singular agent scenarios. RIP 125 - Tree Growth Memory Consumption as Eco- nomic Attack. MCTS tree growth is unbounded without prun- ing—each new node consumes memory. Attackers submit planning problems causing MCTS to grow unbounded trees, exhausting available memory. In multi-agent systems with shared memory, attacking one agent’s tree growth impacts all agents. Single-agent tree exhaustion affects one agent’s mem- ory; multi-agent systems with shared memory pools enable tree exhaustion to crash entire systems. RIP 126 - Semantic Memory Cost Optimization Enabling Resource Exhaustion. Semantic retrieval uses computation- ally expensive embedding operations. Attackers craft queries causing expensive semantic searches consuming resources. Multi-agent systems where each agent independently performs semantic searches multiply resource consumption enabling distributed resource exhaustion. RIP127 - Working Memory Consumption as Resource Hijacking via Context Inflation. Attackers bloat working memory consumption by injecting verbose, low-information- density content forcing agents to consume more tokens for same semantic content. In multi-agent resource-constrained systems, verbose output from Agent A cascades as input to Agent B, compounding token consumption across agent boundaries. A single verbose injection compounds exponen- tially across agent hops, making denial-of-service through token inflation more effective than singular agent inflation where resource waste remains bounded within one context. RIP 128 - Shared Semantic Memory Creating Attribution Confusion for Provenance. Semantic memory distilled from multiple agents’ episodes loses attribution—when Agent A’s solution method becomes ”standard approach” in semantic memory, downstream agents apply this approach unaware it originated from Agent A. Multi-agent semantic memory creates provenance opacity where information flows from specific agents into shared knowledge losing source attribu- tion, enabling trojanized solutions propagating through agent ecosystems as ”established practice.” RIP 129 - Session Persistence Across Agent Boundaries Enabling Cross-Agent Context Poisoning. Context awareness features sharing persisted session state across multiple spe- cialized agents create vulnerability to cross-agent context poi- soning. Compromising one agent’s context enables persistent attacks on all agents in subsequent interactions. In multi-agent systems, poisoned context stored by one agent propagates to others when the session resumes, triggering expensive or malicious operations across all agents. This cross-agent infection vector is unique to multi-agent systems with shared context, unlike singular systems where context remains within one model. RIP1210 - Memory Serialization Storage Cost Ampli- fication. ConversationBufferMemory serialization to storage creates duplicate persistent copies of conversation data. At- tackers craft conversation content with maximum serialization overhead (deeply nested structures, binary data encoded as strings) inflating storage costs per message. Multi-agent shared serialization multiplies this overhead—one expensive message serializes once but is deserialized by N agents, and each deserialization may serialize internally. RIP 1211 - Model Checkpoint Integrity Attacks on Persistent Learning. Agents checkpoint learned weights for resumption. Attackers corrupt checkpoints to activate previously-dormant backdoors during resumption. Learning systems resuming from corrupted checkpoints inherit attacker modifications. Shared checkpoints enable one corruption af- fecting multiple agents. 13) RIP 13 - Infrastructure & Deployment Attacks: RIP131 - Container Escape via Shared Node Enabling Agent-to-Agent Attacks. Containerized agents on shared Ku- bernetes nodes can escape containers to access node resources. Escaped agents can directly attack sibling agent containers. Single-agent container escape affects one agent; escaped agent on shared node can attack all sibling agents simultaneously, enabling one escape to compromise entire co-located agent cohort. RIP132 - Infrastructure Cost Manipulation as Economic Attack. Profiling data showing cost per request could be manipulated to cause agents making economic decisions to be- have incorrectly. Agents receiving cost guidance from central optimization service make coordinated but incorrect economic decisions affecting entire fleet. RIP 133 - NIM Container Image Version Ambiguity and Provenance Uncertainty. NIM image references rely on image tagging for version identification. In multi-agent deployments pulling from floating tags like ”latest”, container upgrade be- haviors become non-deterministic. Attackers compromise im- age registries replacing ”latest” with backdoored versions; all agents auto-pulling ”latest” transparently deploy compromised versions. Unlike singular deployments with pinned versions, multi-agent deployments using floating tags create provenance ambiguity enabling attackers to compromise agents at scale through registry manipulation. RIP 134 - Replica Identity Loss Through Generic Pod Template Scaling. Kubernetes deployments create pod replicas from identical templates lacking unique identity markers. In multi-agent deployments, replicas are interchangeable and attackers exploit this anonymity. Attackers compromise one replica and it remains indistinguishable from others due to identical names. Unlike singular deployments with named servers, multi-agent replica anonymity enables attackers to hide compromised replicas, creating persistent compromise surviving pod restarts. RIP 135 - Cost Attribution Blurring in Multi-Agent GPU Infrastructure. When multiple agents share GPU infrastructure with resource requests, cost attribution per agent becomes ambiguous. Attackers exploit cost ambiguity by inflating their agent’s consumption while attributing it to neighbors, enabling resource-subsidized attacks. Unlike singular deployments with clear allocation, multi-agent shared infrastructure creates eco- nomic attack surfaces. RIP 136 - Provenance Loss in Distributed Engine Caching. TensorRT engines are cached on edge devices to avoid rebuild costs. An attacker with access to one edge device’s file system can replace the cached engine with a back- doored version. Cached engines lack cryptographic bindings to build-time sources. Single cached engine has one provenance chain; multi-agent distributed caching creates many indepen- dent chains where an attacker needing to compromise only one cache can systematically poison all agents at that location. RIP 137 - Resource Contention as Economic Attack Surface in Shared GPU Deployments. Fleet Command’s MIG (Multi-Instance GPU) partitions single GPUs across multiple agents. An attacker controlling one MIG partition can starve sibling agents through power throttling or specific kernel pat- terns. Dedicated-GPU single agents have guaranteed resources; Fleet Command’s MIG-based sharing creates economic attack surfaces where compromising one agent enables attacking sibling agents through shared resource contention. RIP 138 - Horizontal Scaling Creating Replica Identity Ambiguity. Replicas are often identical copies making them interchangeable. This identity ambiguity enables attackers to compromise one replica appearing indistinguishable from others. Unique agent identities would enable anomaly detec- tion; replica anonymity enables attackers hiding compromised instances. RIP 139 - Engine Binary Non-Fungibility Breaking Agent Identity. TensorRT engines compiled for specific GPUs are non-fungible—two engines for the same model but differ- ent GPU architectures produce different results. An attacker migrating an agent from one hardware to another changes its engine, effectively changing its identity without changing its agent ID. Singular agent identity is straightforward; multi- agent systems where agent identity is abstracted from hard- ware variants create identity spoofing where agents change hardware-specific engines without identity change. 14) RIP 14 - ML/Training & Model Attacks: RIP141 - Model Selection as Economic Privilege Boundary Creat- ing Identity Spoofing. Model selection creates ”capability- efficiency frontier” where different models represent different privilege levels. In multi-agent systems, agents’ model selec- tion creates implicit privilege boundaries. Attackers can spoof agent identity by compromising agent API calls to invoke higher-capability models when actually using cheaper mod- els, appearing privileged when operating reduced-capability models. RIP 142 - MLflow Model Registry Identity Spoofing Through Version Tagging and Range Ambiguity. Model reg- istries using semantic versioning create identity spoofing through version tags and range matching, where attackers register malicious versions appearing as legitimate updates. Shared registries create spoofing impacts across all agents. Hardcoded version references resist spoofing; multi-agent sys- tems using shared registry tags or version range queries enable attacker versions to pass validation. RIP143 - Quantization Artifact Provenance Verifica- tion Gaps. Quantization artifacts (calibration data, quantized weights) stored in registries may lack strong provenance verification. Attackers could inject artifacts claiming legitimate provenance, causing agents to load compromised quantiza- tions. Shared quantization artifact repositories enable one compromised artifact affecting all agents querying registry. RIP 144 - Learned Agent Identity Through Behavioral Fingerprinting. Learning-based agents develop distinctive be- havioral signatures through training. Attackers can forge agent identities by training agents to match target signatures. Multi- agent systems with identity-based trust become vulnerable to spoofing. RIP 145 - Training Data Provenance Obfuscation. Learning-basedmodelsobscuretrainingdata provenance—weight parameters don’t obviously indicate training sources. Multi-agent systems using aggregated training data hide component sources more effectively than centralized sources. RIP 146 - Model Ownership Disputes Through Learning- Based Derivation. When agents learn from other agents’ models, ownership boundaries blur. Multi-agent systems with knowledge transfer create complex ownership chains defeating clear provenance. RIP 147 - Computational Cost Emergence Through Learning Efficiency. Learned policies optimizing for computa- tional efficiency may discover ways to reduce cost inappropri- ate in security contexts (disabling monitoring, reducing valida- tion). Agents learning efficiency together develop coordinated cost-reduction strategies. RIP 148 - Training Resource Acquisition Attacking Downstream Agents. Learning requires computational re- sources. In federated multi-agent training, attackers exhaust resources (TPU/GPU) preventing other agents from training. Resource depletion prevents legitimate agents from updating policies while attacker agents continue learning. 15) RIP 15 - Kubernetes & Container Attacks: RIP151 - Kubernetes Service Account Identity Spoofing Enabling Lateral Movement and Token Replay. Kubernetes service accounts authenticate pod identity through tokens, but shared service accounts in multi-agent deployments create identity pooling vulnerabilities. Compromising one agent enables at- tackers to assume the account’s identity and impersonate all agents using that account, facilitating widespread instruction injection and lateral movement. Tokens can be extracted and replayed from external sources. Unlike singular deployments with dedicated credentials, shared service accounts amplify compromise from one agent to all agents through token reuse and identity pooling. RIP 152 - IP Spoofing in Microservices via iptables Manipulation. Agents with certain capabilities can manipulate iptables to spoof source IP addresses in inter-service com- munication. Attackers can forge communication appearing to originate from trusted agents. Single-agent spoofing affects that agent’s outbound identity; multi-agent systems enable attackers to spoof any agent identity in communication, en- abling targeted lateral movement through forged trustworthy communication. RIP 153 - Pod Eviction Ordering Based on Priority Revealing Agent Importance. Kubernetes pod priority controls eviction order during resource pressure. Attackers observing pod eviction patterns infer agent importance and targeting high-priority agents. Priority-based eviction in multi-agent systems reveals workflow importance through eviction behav- ior, enabling attackers targeting critical agents based on pod priority observations. RIP 154 - GPU Resource Request Gaming for Hardware Hoarding. Agents request GPUs from limited pools. Attack- ers manipulate GPU resource requests to hoard accelerators, starving other agents of computation resources. Multi-agent GPU scheduling creates competitive resource allocation en- abling attackers to game GPU requests causing other agents’ model inference to fall back to CPU, creating performance degradation and economic cost externalities. RIP 155 - Namespace-Based Multi-Tenancy Isolation Bypass. Kubernetes namespaces provide soft isolation for multiple agent environments. Attackers with access to one namespace can potentially escape to shared infrastructure (network, compute) affecting other namespaces. Multi-agent multi-tenant clusters enable cross-namespace attacks where compromising one tenant’s agent enables disrupting other tenants’ agents, creating economic attack surfaces unavailable in isolated deployments. RIP 156 - Cluster Node Identity Spoofing in Gossip Protocol Communications. Multi-node vector database clusters use gossip protocols for membership coordination, with nodes identified by CLUSTERHOSTNAME values. Attackers can spoof node identities by forging CLUSTERHOSTNAME values in gossip messages, impersonating legitimate nodes to inject malicious data or disrupt cluster consensus. This identity ambiguity enables data poisoning, query interception, and consensus disruption. Multi-agent systems using clustered vector databases amplify this risk because agents trust cluster topology without verifying individual node identities, and the lack of cryptographic node identity verification means CLUS- TER HOSTNAME is merely an unverified string assertion. RIP 157 - Load Balancer VIP Masking Individual Node Provenance in Query Attribution. Clustered vector database deployments use load balancers with virtual IP addresses (VIPs) to distribute agent queries, but VIP routing masks individual node identities creating provenance gaps where audit logs cannot determine which specific node processed which agent’s request. This prevents post-incident analysis from identifying which agents’ queries were affected by a compromised node. Attackers exploit this by compromising one node knowing that audit logs won’t reveal the specific node identity, enabling persistent data exfiltration with attribu- tion confusion. Single-agent direct node connections maintain clear node-level provenance; multi-agent systems using shared load balancer VIPs eliminate node-level attribution. 16) RIP16 - Load Balancer & Scaling Attacks: RIP161 - Load Balancer Identity Abstraction Enabling Agent Impersonation. Load balancers abstract away replica identity behind single endpoints. Attackers exploiting load balancer state could route requests between arbitrary repli- cas creating appearance that one replica handled requests it didn’t. Direct agent endpoints show clear identity; load balancer abstraction enables identity spoofing through routing manipulation. RIP 162 - Load Balancer Endpoint as Impersonation Target. The load balancer endpoint itself becomes the identity interface. Attackers could intercept or redirect traffic to load balancer creating man-in-the-middle scenarios. Direct agent communication doesn’t require load balancer identity; load balancing creates additional identity layer becoming attack target. RIP 163 - Weighted Load Balancing Creating Privilege Asymmetry. Weighted load balancing routes different traffic percentages to different capability levels. Attackers can infer which agents have higher privilege through traffic routing patterns. Uniform load distribution doesn’t reveal capability differences; weighted routing reveals privilege asymmetry observable as traffic patterns. RIP164 - Auto-Scaling Triggered Identity Discontinuity. When auto-scaling launches new replicas, the new instances have fresh identities with no history. Attackers can trigger scaling forcing discontinuity creating appearance that service returned ”new” agents with fresh state. Static agents have continuous identity history; auto-scaling discontinuity enables impersonation through fresh replica identity. 17) RIP 17 - Service Discovery & Authentication At- tacks: RIP171 - Service Registration Audit Trail Gaps for Provenance Tracking. Kernel service registration modifications aren’t always audited with provenance metadata—who regis- tered service, when, what version, from what source. Shared kernel services create provenance complexity—modification affects all agents requiring tracing which agents depend on which service versions. Singular services have linear prove- nance; shared services have complex provenance. RIP 172 - Message Queue Consumer Identity Spoofing Through Queue Reassignment. RabbitMQ consumer identities derive from consumer tags which are loosely validated. At- tackers can create consumers with spoofed identities causing messages intended for legitimate consumers to be consumed by attackers. Unlike singular queue with one consumer, multi- agent queues with many consumers create identity confu- sion—identity spoofing causes legitimate messages to route to attacker’s consumer, stealing work items intended for trusted agent. RIP 173 - API Gateway Consumer Identity Header In- jection for Rate Limit Bypass. Kong rate limits per consumer tracked through headers like X-Consumer-ID. Attackers injecting spoofed consumer headers appear as different con- sumers, bypassing rate limits. Unlike singular agent rate limiting, identity spoofing affects multiple downstream agents. Multi-agent systems where identity persists through multiple gateways create persistent identity spoofing impact affecting all inter-agent communication. RIP 174 - Prometheus Cardinality Explosion DOS Through Agent Identity Labels. Agents expose metrics with agent_id label creating cardinality for each unique agent. Attackers creating unbounded agent IDs cause metric cardinal- ity explosion exhausting Prometheus storage. Singular agent contributes limited cardinality. Multi-agent systems where attackers can provision unlimited agent instances create un- bounded cardinality explosion enabling attackers exhausting observability infrastructure. RIP 175 - Message Queue Priority Queue Starvation as Economic Attack. RabbitMQ supports priority queues where high-priority messages jump ahead. Attackers creating high- priority messages starve low-priority work of execution, cre- ating economic denial of service. Singular agent economic attack affects one queue. Multi-agent shared priority queues create fleet-wide starvation where attackers starving one queue impact all agents relying on that queue. RIP 176 - DNS Cache Poisoning Affecting Multi-Agent Service Discovery. Service discovery relies on DNS resolv- ing agent hostnames to IPs. Attackers compromising DNS caches can redirect agent-to-agent communication to attacker- controlled endpoints. Single-agent hostname resolution affects that agent; multi-agent systems enable attackers to poison DNS affecting all agents simultaneously, causing system-wide redirection of service discovery. RIP 177 - Certificate Authority Compromise Enabling Agent Spoofing at Scale. Fleet Command uses a centralized certificate authority to issue certificates to edge agents. An attacker compromising the certificate authority can issue cer- tificates for arbitrary agent identities, creating fake agents joining the fleet. In multi-agent coordination, fake agents can impersonate real agents and issue tool calls. Unlike single- agent deployments, multi-agent Fleet Command systems cre- ate attack surfaces if the centralized certificate authority is compromised, enabling systematic agent spoofing across the entire fleet. 18) RIP 18 - Rule/Method/Parameter Attribution Attacks: RIP181 - Efficiency Metric Spoofing for Agent Identity Deception. Agents are sometimes identified/trusted based on efficiency metrics (e.g., ”trust agents achieving ¿90% to- ken efficiency”). Attackers spoof efficiency metrics through false reporting or metric calculation poisoning, appearing as trustworthy efficient agents. Single-agent spoofing affects that agent’s identity perception; multi-agent systems where agent selection depends on efficiency metrics enable attackers spoofing metrics to appear as preferred agents. RIP 182 - Method Authorship Spoofing in Shared Reg- istries. HTN method libraries include author attribution, and attackers spoof authorship to gain credibility. In multi-agent ecosystems with shared method registries, spoofed authorship enables attackers propagating malicious methods as if authored by trusted specialists. Single-agent methods under local con- trol; multi-agent shared registries enable attackers gaining trust through false attribution. RIP183 - Delegation Chain Identity Verification Gaps. HTN hierarchical delegation (Agent A delegates to Agent B, who delegates to Agent C) creates identity verification challenges. Attackers can claim delegation authority they don’t possess. Multi-agent hierarchical systems create N(N- 1)/2 verification overhead in N-agent systems. Single-agent delegation is local; multi-agent delegation chains require iden- tity verification at each step, creating gaps where intermediate agents claim false authority. RIP 184 - Rule Attribution Confusion in Multi-Agent Aggregation. In multi-agent systems aggregating rules from multiple sources (built-in rules, learned rules, shared rules), rule origins become ambiguous. Attackers exploit this by injecting rules that downstream agents incorrectly attribute to trusted sources. Single-agent rule origin is clear; multi-agent rule aggregation creates attribution confusion enabling origin spoofing. RIP 185 - Parameter Origin Confusion in Multi-Agent Systems. Context grounding—validating parameters derive from legitimate sources—becomes complex in multi-agent systems where Agent A’s outputs become Agent B’s inputs. Parameter origin becomes ambiguous, and an attacker com- promising Agent A can fabricate parameters appearing to originate from legitimate sources because Agent B cannot verify the attribution chain. RIP186 - Parameter Source Trust Boundaries. In multi- agent systems, trust boundaries become complex. Single agent trust boundaries are clear (agent has access to resource or not). Multi-agent systems create transitive trust where Agent B trusts Agent A’s parameters without independent authorization verification. Attackers compromising Agent A can manipulate Agent B into operating on unauthorized resources through parameter manipulation appearing from trusted source. RIP 187 - Provider Economic Lock-In Through Ef- ficiency Contracts. Long-term efficiency contracts with providers (committed token usage, bulk API call rates) create economic lock-in. Attackers poison efficiency optimization causing agents to consume more tokens than contracted, triggering overage charges. Single-agent contracts affect that agent’s costs; multi-agent systems with shared provider con- tracts enable attackers triggering system-wide token overcon- sumption through coordinated poisoned optimization. RIP 188 - Method Contributor Accountability in Dis- tributed Method Development. When multiple agents con- tribute methods to shared registries, attackers contributing malicious methods face minimal accountability if the registry doesn’t track contributor identity cryptographically. In multi- agent ecosystems with loose contributor identification, attack- ers can contribute malicious methods with low accountability risk. Centralized method development has clear authorship versus distributed development with weak contributor tracking. RIP 189 - Rule Authorship Spoofing Through Descrip- tion Manipulation. Rule-based systems may track rule au- thorship. Attackers exploit this by crafting rule descriptions appearing to originate from trusted sources. In multi-agent systems with shared rule repositories, false provenance claims enable attackers injecting rules with fake authorship cre- dentials. Single-agent rule authorship tracking remains lo- cal; multi-agent shared repositories enable attackers falsifying provenance affecting trust across all agents. RIP 1810 - Rule Version Control Poisoning. Rules evolve through versions. Attackers exploit version control by injecting malicious versions appearing as legitimate updates. In multi- agent rule ecosystems with shared version control, poisoned versions propagate across all agents upgrading. Single-agent rule versioning affects one agent; multi-agent shared version control enables attackers poisoning versions affecting entire ecosystems. 19) RIP 19 - Hybrid & Cross-Paradigm Attacks: RIP191 - Paradigm Attribution Confusion in Hybrid Com- ponent Source Validation. Hybrid systems integrate compo- nents from different paradigms, potentially from different sources (externally-provided neural models, enterprise rule repositories, third-party utility functions). Single paradigm components have clear provenance; hybrid multi-paradigm components create complex provenance chains. Multi-agent paradigm sharing enables 1-to-N compromise where poisoning shared paradigm components affects entire agent ensemble. RIP 192 - Identity Spoofing Through Paradigm-Specific Credential Mechanisms. Different paradigms use different credential mechanisms (neural models’ embeddings, symbolic rules’ schemas, utility functions’ preference signatures). At- tackers craft credentials spoofing specific paradigm types gain- ing access as trusted components. Single paradigm credential validation is type-specific; hybrid multi-paradigm credential diversity creates confusion. In traditional software, ”code” and ”data” are clearly distinct. In AI agent systems built on LLMs, natural-language content from users, tools, web pages, emails, PDFs, and inter- nal documents functions as both data and control logic. This conflation represents a foundational ”cognitive” vulnerability in agentic AI. This enables three primary control-flow attack classes: • Direct and indirect prompt injection: Adversarial con- tent instructing models to override system policies, exfiltrate secrets, or call dangerous tools. Indirect attacks embed in- structions in retrieved documents and third-party pages, hiding payloads from users but exposing them to agents. • Cross-context and cross-modal injection: Instructions hidden in HTML attributes, CSS, comments, PDFs, or OCR- extracted images that models treat as higher-priority guidance than system prompts. Uniqueness vs. traditional software: The vulnerability stems from learned, stochastic policy semantics—untrusted natural language interpreted as instructions—rather than pars- ing, query construction, or type systems. No direct analogue exists in compiled or scripted systems. 20) RIDC 1 - UI and User Interaction Attack Surfaces: RIDC11 - Progressive Disclosure as Attack Surface Ex- pansion. Progressive disclosure patterns (essential, expanded, technical views) create multiple injection points. Multi-agent systems amplify this risk: attackers embed malicious instruc- tions in technical-detail layers that user-facing agents ignore but backend agents execute. A single UI component presents benign content to humans while delivering malicious instruc- tions to downstream agents in unexpanded views. Multi-agent policy gaps across disclosure levels enable attackers to craft payloads exploiting different access policies—a threat absent in singular agent systems. RIDC 12 - Chat Interface Attribution Confusion En- abling Social Engineering. Chat interfaces blur lines between users, agents, tool outputs, and documents. In multi-agent systems this risk escalates: interfaces must distinguish user vs. multiple agents vs. tool output vs. RAG content vs. inter-agent communication. Without clear identity markers, attackers inject content appearing to originate from trusted agents while sourcing from compromised data. Multi-agent systems require complex attribution graphs; singular agent systems face simpler user-vs-agent distinctions. RIDC 13 - ARIA Live Region Manipulation as Persis- tent Context Injection Vector. ARIA live regions announce dynamic content updates to screen readers. In multi-agent sys- tems, adversaries compromise content populating live regions, injecting instructions disguised as status updates. Multi-agent systems create dual-channel context consumption: humans see legitimate visual displays while monitoring agents consume ARIA-enhanced DOM trees. Persistent live regions mean injected instructions survive across multiple agent interactions until explicitly cleared, creating durable context pollution unique to accessibility-enhanced multi-agent monitoring. RIDC14 - Keyboard Shortcut Accessibility Feature as Out-of-Band Instruction Channel. Agent UIs implement key- board shortcuts for approval workflows and accessibility. In multi-agent systems where workflow agents observe and learn approval patterns, adversaries exploit shortcuts as instruction channels by manipulating configurations or injecting mali- cious policies into help dialogs consumed by learning agents. Multi-agent workflow systems create observation-based policy learning where approval agents execute shortcuts, learner agents infer policies from behavior, and documentation agents maintain authoritative help text. In federated systems, shortcut configurations propagate across agent boundaries as learned preferences, creating transitive instruction injection vectors. RIDC 15 - Accessibility Semantic Landmarks as Cross- Agent Identity Spoofing Vector. Semantic HTML landmarks enable screen reader navigation. In multi-agent systems com- municating via shared UI contexts or DOM-based message passing, adversaries exploit semantic structure for attribution confusion. Attackers inject fake agent messages using proper semantic structure mimicking legitimate responses, including ARIA roles and heading hierarchies signaling authenticity. Multi-agent collaborative systems share semantic spaces where multiple agents contribute to the same DOM; adversaries inject hidden content that adds malicious instructions invisible to humans but present in agent context windows. RIDC 16 - Command Palette Context Prediction as Covert Instruction Channel. Command palettes suggest contex- tually relevant actions via AI analysis of current state. In multi- agent systems, context aggregates from multiple sources (code analysis, user behavior, project context agents). Attackers poison context sources to manipulate suggestions, embedding malicious instructions in documentation causing the palette to suggest dangerous operations. Multi-agent suggestion logic depends on consensus across context providers; compromising one source biases suggestions while singular agent systems make context poisoning more detectable. RIDC 17 - Error Communication Auto-Retry as Attack Amplification. Automatic retry with exponential backoff am- plifies instruction injection by repeatedly executing malicious operations disguised as retries. In multi-agent error recovery (monitoring agent→ retry agent→ execution agent), attackers craft inputs triggering errors in early agents while executing malicious payloads in retry agents. Multi-agent retry logic cre- ates unique opportunities where monitoring agents see benign content while execution agents see injected instructions, with attack surfaces absent in singular agent systems with unified error handling. RIDC 18 - Notification Pattern Time-Based Default Es- calation as Injection Vector. In multi-agent systems, time- based notification defaults create attack surfaces through cross- agent timing coordination. Attackers control Agent A to gen- erate notifications expiring precisely when Agent B expects human confirmation, creating transitive trust chains where Agent B cannot verify whether timeout-based approvals repre- sent genuine user non-responses or adversary-injected claims. Multi-agent uniqueness emerges from these transitive trust chains—singular systems have one trust boundary; multi-agent systems create instruction-data conflation where downstream agents cannot verify timeout-based approvals. 21) RIDC 2 - Messaging and Protocol Injection: RIDC21 - FIPA-ACL Performative Spoofing and Com- munication Layer Injection. In message-passing multi-agent systems (FIPA-ACL, KQML), attackers exploit semantic gaps between performative metadata (message intent) and content to inject malicious instructions manipulating inter-agent control flow. Malicious agents craft messages where performative contradicts content—INFORM performatives containing exe- cutable instructions bypassing authorization checks for RE- QUEST types. Unlike singular tool-calling attacks, perfor- mative spoofing crosses agent boundaries via communica- tion protocols, exploiting assumptions that correctly-formatted messages are semantically valid. RIDC 22 - Protocol Language Downgrade Attacks via Serialization Format Conflation. Multi-agent systems sup- porting heterogeneous formats (JSON, XML, YAML, Proto- col Buffers) face downgrade attacks where adversaries force weaker parsing, enabling injection. Malformed Protocol Buffer messages trigger automatic JSON downgrade where loosely- typed fields allow injection that Protocol Buffers would reject. Multi-agent systems negotiate formats dynamically across boundaries, creating vectors where adversaries probe formats, identify weakest parsers, and craft exploits leveraging format downgrade paths unavailable in homogeneous single-format systems. RIDC23 - Conversation-ID Chain Hijacking for Context Pollution Across Agent Workflows. Message-passing proto- cols use conversation-id fields linking related messages into coherent exchanges. Attackers inject malicious messages mid- conversation appearing as legitimate inter-agent communi- cation, polluting shared context downstream agents inherit. Unlike singular prompt injection requiring sanitization bypass, conversation-id hijacking bypasses sanitization by appearing as legitimate inter-agent communication. Vulnerability ampli- fies in hierarchical orchestration where supervisors aggregate results using conversation-id filtering—injected summaries propagate to higher layers creating cascading pollution. 22) RIDC 3 - Framework and State Management In- jection: RIDC31 - Framework-Enforced Trust Boundary Violations Through State Schema Coercion. Framework ar- chitectures (LangGraph, CrewAI, AutoGen) impose specific state management models where different frameworks enforce different boundaries between data and control flow. Attackers exploit framework-specific state schema definitions to inject malicious instructions that pass framework validation but execute as control flow in downstream agents. Multi-agent risk emerges because state flows across framework bound- aries—LangChain’s conversation history serializes to JSON for CrewAI agent consumption, with transformation losing semantic tagging. RIDC 32 - Cross-Framework State Migration Enabling Transitive Instruction Propagation. Multi-agent systems often migrate state between frameworks during workflow transitions, creating instruction propagation opportunities where malicious payloads deliberately crafted for one framework’s state model execute in different contexts in another framework. When LangChain’s agent memory migrates to LangGraph’s explicit state management, data becomes code—instructions embedded in buffer history activate as state schema field content in a different semantic context. Unlike singular systems where state remains within one framework’s validation boundaries, multi-agent orchestration creates state transformation points where instruction-data conflation compounds across frame- work boundaries. RIDC 33 - State Schema Field Injection via Reducer Confusion. Malicious agents submitting state updates exploit reducer behavior where custom reducers append data without sanitization. In multi-agent LangGraph workflows, Agent A might inject malicious instructions into state fields that only specific reducers process, remaining invisible to agents using default overwrite reducers. Single-agent systems have one reducer application per field; multi-agent systems have hetero- geneous agent understanding of reducer semantics, enabling injected instructions surviving in some agents’ views but not others. RIDC 34 - Conditional Edge Routing Hijacking via State Manipulation. LangGraph’s conditional edges route based on state field evaluation. Attackers compromise agents feeding state, injecting malicious values causing conditional edges to misroute workflows to unintended paths. Single-agent routing depends on one model’s output; multi-agent conditional rout- ing aggregates state from multiple agents, and compromising any upstream agent poisons routing for all downstream agents sharing the same conditional edge. 23) RIDC 4 - Tool, Function Calling, and Plugin Injec- tion: RIDC41 - Memory-Driven Tool Selection Manipula- tion via Conversation History. Conversation history stored via ConversationBufferMemory becomes vulnerable to injection attacks where malicious instructions embedded in historical exchanges hijack subsequent tool selections without requiring direct prompt manipulation. When memory reconstructs the prompt before each agent invocation, attackers inject instruc- tions early that persist through memory retrieval. In multi- agent systems sharing conversation history through memory, one agent’s compromised history contaminates downstream agents—unlike singular agents that isolate history within one context window. RIDC 42 - Tool-Calling Schema Instruction Boundary Collapse. Tool-use architecture’s schema-driven interfaces cre- ate instruction-data conflation where malicious instructions in tool parameters or return values exploit semantic boundaries between data and instructions. Adversaries embed instructions in data fields passing schema validation (syntactically correct but semantically malicious). In multi-agent systems, Agent A’s poisoned output becomes Agent B’s trusted input context, creating ”tool output laundering” attacks where Agent B lacks visibility into Agent A’s original calls. RIDC43 - Tool Description Injection Through RAG- Retrieved Tool Metadata. Tool descriptions in LangChain agents are natural-language guidance that models use to select tools, making them vectors for instruction injection when tool metadata is dynamically retrieved from RAG pipelines or external tool registries. Multi-agent systems with shared tool registries or RAG-based tool discovery enable one poisoned tool definition affecting all agents querying that registry; singular agents with hardcoded tool definitions lack this shared infrastructure attack surface. RIDC 44 - Function Calling Parameter Injection via Type Coercion. Function calling generates structured JSON with parameters extracted from conversation context, but type coercion during parameter extraction creates injection oppor- tunities when natural language contains type hints attackers exploit. Multi-agent function calling chains where Agent A’s parameter extraction feeds Agent B’s invocation enable attacks where poisoned parameters persist through type coercion chain. Single agents validate parameter types once; multi- agent chains create opportunities for type confusion escaping validation at intermediate points. RIDC 45 - Implicit Tool Calling Assumptions Across Agent Boundaries. Function calling architecture assumes LLMs never directly execute functions—only generate rec- ommendations. This assumption holds for individual agents but breaks in multi-agent systems where Agent A generates function call JSON that Agent B interprets, potentially exe- cuting instructions Agent A intended as data. Transitive trust where downstream agents assume upstream agents’ function calling output represents legitimate tool invocations creates vulnerabilities conflating data with executable operations. RIDC46 - Plugin-Function Metadata Injection Through DecoratedFunctionDescriptions.SemanticKernel’s @kernel_function decorators expose function metadata directly to orchestrator LLMs that select plugins based on descriptions. Attackers inject malicious descriptions into function definitions during plugin registration or through RAG-indexed plugin documentation. Plugin registries in multi-agent systems create centralized metadata injection points where poisoning one plugin definition affects all agents querying that registry; singular agent tools with hardcoded descriptions lack this shared registry attack surface. RIDC 47 - Semantic Function Template Injection via Variable Interpolation. Semantic Kernel’s semantic functions use prompt templates with variable injection ($variable_name). Attackers inject template syntax through plugin parameters causing malicious instructions to execute during template rendering. Multi-agent semantic func- tion pipelines where Agent A’s output becomes Agent B’s input variables create cascading template injection opportu- nities—Agent A’s poisoned output embeds template syntax executed by Agent B’s template rendering, creating instruction propagation through semantic function chains. RIDC 48 - Native Function Parameter Type Coercion as Control-Flow Attack. Native functions receive injected dependencies (HTTP clients, database connections) through constructor injection rather than creating their own. Attackers exploit type coercion between services where HTTP client interfaces can be implemented by malicious proxies appearing as legitimate dependencies. Kernel-level dependency injec- tion centralizes all agent service resolution—compromising the kernel’s service registration enables injecting malicious implementations affecting all agents simultaneously; singular agents with hardcoded dependencies resist this attack. RIDC 49 - Plugin Discovery Protocol Spoofing Through Crafted Function Schemas. Plugin registration schemas de- scribe available functions using natural language descriptions. Attackers craft schema descriptions exploiting ambiguity in language where a function description could refer to different semantic operations. Multi-plugin orchestration with dozens of plugins creates combinatorial ambiguity in function match- ing—attackers exploit vagueness where descriptions could match multiple plugins enabling unintended routing; singular agent systems with explicit tool selection avoid this semantic ambiguity. RIDC 410 - Tool Schema Evasion Through Boundary Misinterpretation. Tool schemas define input/output contracts between agents and tools, creating instruction-data boundaries that LLMs may misinterpret when processing tool results. Ma- licious tool outputs formatted to match schema types bypass validation because they satisfy syntactic requirements while containing semantic payloads. When Agent A executes a tool receiving schema-compliant but semantically malicious output and forwards it to Agent B as trusted input, the instruction-data conflation propagates—unlike singular agent systems where output validation remains within one context. 24) RIDC 5 - ReAct and Reasoning Architecture Injec- tion: RIDC51 - ReAct Reasoning Trace Injection. Re- Act’s explicit reasoning traces create attack surfaces where malicious instructions in observation data hijack subsequent reasoning. In multi-agent systems, reasoning traces shared across agents for coordination create cascading vulnerabilities where Agent A’s poisoned observations propagate as legitimate reasoning to Agent B. Unlike singular systems where injection impacts one session, multi-agent ReAct amplifies through trace sharing—one compromised observation poisons multiple downstream agents. RIDC 52 - Trace Artifacts as Post-Hoc Rationalization Injection Vector. When agents generate explanatory reason- ing traces that don’t reflect internal computational processes, multi-agent systems amplify the vulnerability through trace reuse. Agent B consumes Agent A’s unfaithful reasoning trace as ground-truth context without being able to distinguish faith- ful reasoning from post-hoc rationalization. Unlike singular agents where trace-generation mechanisms remain localized, multi-agent systems propagate unfaithful traces across bound- aries, enabling instruction injection through trace reuse. RIDC 53 - Mechanistic Interpretability Opacity Creating Cross-Agent Blind Spots. Multi-agent systems create vulnera- bility when downstream agents cannot access upstream agents’ internal computational graphs. Agent B receives Agent A’s outputs without visibility into whether those outputs reflect genuine reasoning or post-hoc rationalization. The instruction- data conflation emerges because computational opacity forces Agent B to treat all outputs identically regardless of internal validity, and attackers inject instructions triggering plausible external outputs while activating incorrect internal circuits. RIDC 54 - Plan-and-Execute Planning Phase Conflation Attack. Plan-and-Execute separates planning from execution, creating vulnerability where adversaries inject malicious in- structions during planning that persist throughout execution. In multi-agent supervisor-worker delegation, poisoned planning becomes embedded in execution plans; no individual agent recognizes malicious instructions because each sees only iso- lated subtask context. Multi-agent execution fragments across specialized agents creating ”responsibility diffusion” where no agent sees complete attack surfaces, with semantic gap exploits and transitive trust enabling attacks absent in singular systems. RIDC 55 - Precondition Smuggling in Abstract Task Decomposition. Preconditions in decomposition methods are specified as natural language logical expressions that LLMs interpret, creating injection vectors where attackers embed instructions in precondition descriptions causing unintended method selection. In multi-agent hierarchical systems, Agent A (planner) evaluates preconditions through natural language prompts while Agent B (executor) operates on selected de- compositions, creating semantic gaps where poisoned precon- ditions trigger unauthorized decomposition methods. Multi- agent hierarchies create transitive trust where downstream executing agents inherit precondition decisions without re- evaluating the natural language expressions. RIDC 56 - Abstract Task Description as Implicit In- struction Channel. Abstract task descriptions in HTN method libraries encode documentation that functions as instructions when LLMs process decomposition methods. Multi-agent HTN systems where Agent A constructs task descriptions from user input and Agent B uses those descriptions to select methods enable instruction injection through documentation conflation. Unlike single-agent HTN where descriptions re- main local, multi-agent method libraries become centralized instruction repositories that all agents consume, amplifying description-level injection to all agents simultaneously. RIDC 57 - Constraint Specification Ambiguity Enabling Ordering Manipulation. Ordering constraints in HTN methods specify task precedence using natural language vulnerable to ambiguous interpretation. In multi-agent hierarchical planning, Agent A (strategic planner) specifies constraints while Agent B (tactical planner) interprets them, creating semantic slippage. Multi-agent systems with heterogeneous constraint interpreters enable instruction injection through ambiguous constraints where attackers craft specifications exploiting interpretation gaps, causing unintended execution orders bypassing intended safety sequencing. RIDC 58 - Effects Specification Injection Through State Change Description. Method effects specify how world state changes after execution, described in natural language. Attack- ers inject instructions into effect descriptions claiming unau- thorized side effects that agents execute during state updates. In multi-agent HTN systems where Agent A (planner) spec- ifies effects and Agent B (executor) applies them, poisoned effect descriptions become control-flow instructions. Multi- agent systems create trust boundaries enabling instruction injection through effect descriptions where Agent B assumes Agent A’s specifications are legitimate data. RIDC 59 - Data Dependency Injection Through Causal Link Manipulation. Causal links specify data flows between tasks using natural language. In multi-agent HTN systems, attackers inject instructions into causal link descriptions caus- ing unintended data flows. Multi-agent hierarchies where causal links span agent boundaries enable attackers poisoning shared causal link specifications causing cascading misdirec- tion. Single-agent HTN keeps causal links local; multi-agent hierarchical systems with shared causal link specifications enable instruction injection through data dependency docu- mentation affecting all agents. RIDC 510 - Method Proliferation Enabling Hidden In- struction Encoding. HTN method libraries can contain hun- dreds of decomposition methods, and attackers can inject mali- cious methods appearing as legitimate alternatives for standard abstract tasks. In multi-agent systems where all agents query shared method libraries, injected malicious methods become available to every agent. This attack scales with agent count; compromising a library serving 20 agents enables 20-agent compromise through a single method injection, compared to single-agent systems requiring per-agent exploitation. RIDC 511 - Reflection Self-Critique Reinforcement Hi- jacking. Reflection’s self-critique mechanism amplifies mali- cious instructions through iterative validation loops. In multi- agent dual-agent critic patterns, producer agents generate out- puts with injections while critic agents validate and strengthen them. Each generate-reflect-refine cycle amplifies attacks rather than removing them, making injections sophisticated and indistinguishable from legitimate reasoning. In multi-agent systems with shared-memory coordination, one agent’s poi- soned reflections contaminate other agents’ reasoning contexts. 25) RIDC 6 - Streaming and Real-Time Communication Injection: RIDC61 - Streaming Response Manipulation Through Timing Attacks. Streaming progressively displays output, creating vulnerability windows for timed injections. Multi-agent workflows amplify this: one agent’s streaming output becomes another’s input. Attackers embed malicious instructions in middle sections of long responses, exploiting users’ focus on beginnings and endings. Streaming handoffs between agents create multiple injection points; timing-based attacks bypass human review through non-deterministic gen- eration speeds and latency variations absent in singular agent systems with atomic responses. 26) RIDC 7 - Generation Parameter and Inference Con- figuration Injection: RIDC71 - Evaluation Dataset Poi- soning Through Training Data Injection. Evaluation datasets constructed from production logs, historical user queries, or internal data become attack vectors when containing adversar- ial inputs. In multi-agent systems where evaluation datasets are shared across specialized evaluation agents, poisoning the shared dataset affects all agents simultaneously. A single injected adversarial query in the evaluation corpus propagates to all agents’ measurements, causing systematic evaluation bias across all metrics unlike singular agent systems where evaluation runs in isolation. RIDC 72 - Evaluation Metric Selection Manipulation Via Prompt-Based Metric Design. Evaluation metrics in agent systems often use natural language definitions that LLM- based evaluators interpret. In multi-agent evaluation pipelines with specialized evaluator agents, attackers poison the natural language metric definitions causing evaluators to measure different dimensions than intended. Multi-agent systems are uniquely vulnerable because poisoning centralized metric def- initions affects all agents’ measurements, creating Trojan eval- uation metrics measuring attacker-favorable outcomes while appearing to measure legitimate quality. RIDC 73 - Baseline Measurement Manipulation Through Agent Substitution. Baseline establishment compares new agent versions to ”known good” baseline performance. In multi-agent systems, attackers can inject compromised agents as baselines, causing new agents to appear degraded relative to corrupted reference points producing systematically biased results. Multi-agent architectures distribute baselines across multiple agents creating inconsistent comparisons when base- line establishment lacks agent authentication. Unlike singular systems where baseline comparison is deterministic, multi- agent systems enable attackers to substitute poisoned base- lines. RIDC 74-Multi-AgentEvaluationOrchestration Control-Flow Hijacking. Evaluation pipeline orchestration coordinates multiple agents (test dataset agents, metric computation agents, comparison agents, decision-making agents) through control flow (which agent runs, when it runs, which output routes to which next agent). Attackers hijack orchestration by injecting instructions into agent outputs that downstream agents execute as control directives, enabling disabling of safety gates through outputs framed as legitimate recommendations. RIDC 75 - Test Dataset Ordering Attacks Through Non- Deterministic Evaluation Sequencing. Evaluation pipelines processing test cases may produce different results based on ordering due to caching, learned state, and resource con- straints. In multi-agent evaluation, distributed agents process test cases in non-deterministic order without explicit synchro- nization. Attackers exploit ordering by controlling execution scheduling to force specific test case orderings that trigger specific agent behaviors. Multi-agent evaluators’ parallel pro- cessing creates ordering variability enabling attacks requiring specific state sequences, unlike singular evaluators processing tests sequentially. RIDC 76 - Evaluation Context Memory Poisoning Through Agent State Pollution. Multi-agent evaluation agents maintain evaluation state across test batches. Attackers poison this persistent state by injecting malicious information into early test batches that affects later evaluation decisions. Unlike singular evaluation with isolated test processing, multi-agent evaluation’s persistent cross-batch state creates temporal in- jection vectors where early pollution compounds through later tests through shared state that accumulates knowledge across batches for efficiency. RIDC 77 - Metric Calculation Hijacking Through Cus- tom Metric Function Injection. Custom evaluation metrics implemented as Python functions can be exploited if met- ric definitions come from untrusted sources (RAG-retrieved metric definitions, user-provided scoring functions, dynami- cally loaded validators). Multi-agent evaluation systems where different agents implement different metrics enable attackers injecting metrics that measure positively for compromised behaviors, and cross-agent metric aggregation hides individual metric poisoning in averaged results. RIDC 78 - Confidence Score Inflation in Custom Evalua- tion Metrics. Custom evaluation metrics return normalized 0-1 scores that aggregate into system metrics. Attackers exploit custom metric implementations to artificially inflate scores through clever implementation of scoring functions. In multi- agent evaluation, attackers compromise one agent’s metric implementation, causing its inflated scores to skew aggregate evaluation benefiting all agents that contributed to that metric calculation. RIDC 79 - Baseline Metric Manipulation for Regression Detection Evasion. Regression detection compares current metrics against baseline metrics. If baselines are stored in mu- table databases or recalculated at runtime, attackers could ma- nipulate baselines making regressions appear as improvements. Multi-agent systems with shared baseline storage enable one agent’s baseline manipulation affecting all agents’ regression detection across entire evaluation frameworks. RIDC 710 - Benchmark Ground Truth Injection as Eval- uation Poison. Benchmarks serve as ground truth for evaluat- ing agent performance, but compromised ground truth labels enable attackers to train or select agents toward malicious behavior appearing as correct performance. In multi-agent sys- tems where agents use benchmark performance to determine mutual trust, poisoned benchmarks corrupt agent-to-agent trust relationships, creating distributed policy misalignment distinct from single-agent overfitting. D. Long-lived cognitive state abuse: memory poisoning and latent backdoors Agent survey papers and threat models emphasize thatmostAIagentsmaintainpersistentcognitive state—scratchpads,vectormemories,tasklists,and knowledge bases—used to guide future behavior. This state is continuously read and rewritten by the LLM itself. [dl.acm](https://dl.acm.org/doi/10.1145/3716628) Attackers can: • Poison agent memory and knowledge: by inserting adversarial ”notes to self,” pseudo-facts, or instructions into long-term memory or vector stores (via user inputs, documents, or RAG sources), so that future tasks retrieve and treat them as authoritative, making malicious actions look like the agent merely ”following its own plan.” [blog.virtueai](https://blog.virtueai.com/2025/06/25/the- hidden-dangers-in-your-ai-agent-why-traditional-security- falls-short/) • Install latent cognitive backdoors: where certain phrases, entities, or task contexts act as triggers that cause the agent to deviate sharply from its apparent policy, even if the base model looks benign on standard evaluations. [arxiv](https://arxiv.org/html/2507.06850v3) Uniqueness: Configuration tampering exists in traditional systems, but here the semantics of memory are defined by a learned policy, not explicit code. Poisoned memories act like hard-to-detect cognitive backdoors, triggered by natural- language patterns and often invisible to static analysis. 1) RMP 1 - UI/UX Memory Manipulation Attacks: RMP 11 - Session Persistence Memory Poisoning Through Progressive Context Accumulation. Session persistence across hours or days creates long-lived cognitive state vulnerable to gradual poisoning via incremental instruction injection. In multi-agent systems where session state propagates across specialized agents, early injections remain dormant until trig- gered in later agents—a temporal gap that prevents users from connecting injection to exploitation. Single-agent systems lack this cross-agent propagation path. RMP 12 - Conversation History Display Provenance Opacity. Conversation history displays fail to distinguish user- generated messages, agent-inferred statements, tool outputs, RAG-retrieved content, and inter-agent communications, cre- ating provenance opacity that attackers exploit for memory poisoning. Multi-agent systems amplify this because each agent adds to history through specialized processing, and the UI flattens heterogeneous provenance chains into linear timelines—making poisoned entries indistinguishable from authoritative content even when users review history. RMP 13 - Context Awareness Reference Links as La- tent Backdoor Activation. Reference links connecting current responses to earlier context create latent backdoor activation mechanisms when historical references point to poisoned memory. In multi-agent systems, cross-agent context sharing enables cross-agent backdoor activation: Agent A processes poisoned input and stores it in shared session memory; Agent C inadvertently activates that backdoor weeks later via an innocent contextual reference. Temporal and functional separation between poisoning and activation defeats security monitoring that treats the two events as unrelated. RMP 14 - Session State Persistence and Resumption as Permanent Cognitive Corruption. Session state persisting across reboots creates permanent cognitive storage vulnera- ble to memory poisoning that outlasts typical security ses- sion boundaries. Multi-agent systems compound this because distributed session state—including inter-agent coordination state—is automatically restored across all agents without revalidation, propagating any poisoned component into new sessions fleet-wide. RMP 15 - Current Task Context Panel Manipulation Through Metadata Injection. Current task context panels ag- gregate metadata from multiple sources, creating attack sur- faces where metadata injection poisons agent understanding of task scope. In multi-agent systems, poisoned metadata (e.g., falsely claiming admin credentials are loaded) causes down- stream agents to act on fabricated state, exploiting implicit trust that displayed context reflects actual system state. RMP 16 - Conversation Thread Continuity as Cross- Session Instruction Persistence. Conversation thread continuity across session boundaries enables malicious payloads injected early to remain semantically active in later sessions. Multi- agent systems are uniquely vulnerable because threads per- sist across agent specialization boundaries: poisoning injected during a low-privilege research agent interaction affects high- privilege execution agents that reference the same thread history, with no enforcement of security context boundaries between sessions. RMP 17 - Progressive Disclosure Collapsed State as Hid- den Memory Corruption. Progressive disclosure patterns col- lapse inter-agent communications, tool outputs, and reasoning traces into hidden UI layers, creating memory corruption that users rarely inspect. In multi-agent systems, collapsed content aggregates from multiple agents, and attackers specifically target these hidden layers to plant backdoors that remain invisible during standard operation while persisting in the underlying cognitive state. RMP 18-ContextualCommandSuggestionsas Memory-BasedBackdoorTriggers.Commandpalette suggestions derived from accumulated session history create memory-based backdoor triggers where poisoned historical context produces malicious command recommendations. In multi-agent systems, suggestions aggregate across multiple specialized agents; poisoning any contributing agent’s memory manipulates which commands appear as trusted AI recommendations, exploiting low-friction keyboard-driven acceptance to bypass security scrutiny. RMP 19 - Multi-Agent Dashboard Context Switching as Memory Isolation Failure. Multi-agent dashboards displaying separate chat panels for different agents create visual isolation that misleads users into assuming cognitive isolation. When agents share backend session state or context stores, poisoning one agent’s context contaminates others invisibly—a failure mode absent in single-agent systems where memory bound- aries align with the visual interface. RMP 110 - Inline Suggestion Acceptance as Persis- tent Memory Modification. Inline suggestions accepted into user documents via low-friction keystrokes create persistent memory modification when accepted content carries embed- ded malicious instructions. In multi-agent systems, accepted suggestions enter the document corpus that RAG systems retrieve and downstream agents process, creating cascading contamination where one poisoned suggestion corrupts the entire project context across all agents. RMP 111 - Context Window Limit Warnings as Memory Eviction Attack Vectors. Context window management that silently evicts older content creates attack opportunities where adversaries inject high-priority malicious instructions designed to survive eviction while security constraints are dropped. Multi-agent systems with heterogeneous context window sizes create exploitable inconsistencies: Agent A evicts a security constraint due to its smaller window while Agent B retains it, producing desynchronized security postures that the UI’s unified conversation display conceals. 2) RMP 2 - Multi-Agent State Handoff and Cross-Agent Memory Attacks: RMP21 - API Gateway Routing Manipu- lation for Cross-Agent Tool Delegation RCE. Federated multi- agent architectures using API gateways for service discovery require dynamic routing vulnerable to manipulation. Attackers compromising service registries redirect tool invocations to attacker endpoints that receive full context including sensitive data and credentials. Unlike single-agent systems with hard- coded endpoints, federated systems require discovery across organizational boundaries without endpoint authenticity veri- fication. RMP 22 - gRPC Schema Versioning Attacks for Backward-Compatible Exploitation. Protocol Buffers back- ward compatibility enables newer schema versions to carry hidden malicious fields that older agents ignore and forward unchanged. Attackers craft requests with legitimate fields plus malicious schema extensions (e.g., admin override=true) that pass invisibly through intermediary agents and execute only at attacker-controlled targets that deserialize the newer schema. RMP23 - Swarm Intelligence Local Rule Injection for Emergent Malicious Behavior. Swarm-based systems using decentralized local rules create attack surfaces where modified rules corrupt emergent behavior without commanding individ- ual agents. Attackers introduce biased agents whose modified rules appear locally compliant while causing the collective behavior to systematically deviate, exploiting the absence of emergent-behavior validation in real-time swarm systems. RMP24 - Cross-Type Memory Poisoning via Retrieval Mechanism Exploitation. Attackers exploit distinct retrieval mechanisms across memory types to inject malicious content into one type that gets misretrieved as another. Multi-agent handoffs lose type metadata during serialization, causing false semantic facts stored as episodic memories to be treated as le- gitimate past events by downstream agents—a type-confusion vulnerability absent in single-agent systems with consistent type boundaries. RMP 25 - Adversarial Importance Weighting for Se- lective Memory Retention. Attackers manipulate importance- based preservation to ensure malicious memories persist while security constraints decay. Multi-agent systems with heteroge- neous importance scoring allow adversaries to craft payloads that score high for retention in operational agents but low in security monitoring agents, exploiting asymmetric decay to entrench malicious patterns as ”important” learned behaviors. RMP 26 - Inter-Agent Memory Type Misclassification During State Handoff. Attackers exploit handoff serialization to cause memory type misclassification, transforming episodic events in Agent A into semantic knowledge in Agent B. The misclassification scales through agent chains—each handoff degrades type integrity, converting specific past events into broad semantic ”truths” applied universally by downstream agents. RMP 27 - Similarity-Search Poisoning via Semantic Anchor Injection. Attackers inject crafted semantic ”anchor” memories whose embeddings are proximate to legitimate operational queries, causing malicious context to co-retrieve with legitimate queries across agent networks. This includes multimodal anchors—images whose embeddings align with legitimate query concepts but encode hidden malicious instruc- tions invisible to visual inspection. Multi-agent amplification occurs when poisoned embeddings enter shared knowledge bases, creating a single point of failure that contaminates retrieval across dozens of specialized agents. RMP 28 - Cross-Agent Vector Embedding Poisoning. Attackers inject malicious content into shared vector databases with embeddings crafted to semantically align with trusted queries, causing adversarial information retrieval across mul- tiple agents in collaborative systems. RMP29 - Knowledge Graph Relationship Injection via Agent Coordination. Malicious agents insert false multi-hop relationships into shared knowledge graphs, exploiting cross- agent traversal patterns to create spurious connections influ- encing collective decision-making through fabricated causal chains. RMP 210 - Distributed Knowledge Graph Traversal Race Conditions. Concurrent multi-agent graph traversals combined with asynchronous updates create race conditions where agents decide based on inconsistent graph snapshots, enabling attack- ers exploiting temporal inconsistencies in relationship visibil- ity. 3) RMP 3 - Multimodal and Cross-Modal Poisoning At- tacks: RMP31 - Cross-Modal Instruction Injection Attack. Attackers embed malicious instructions in non-text modali- ties (images, audio, sensor data) bypassing text safety filters while exploiting multimodal fusion. In multi-agent systems, compromised agents’ poisoned outputs become trusted inputs for downstream agents, creating cascading injection across networks. RMP 32 - Temporal Sensor Desync Exploitation Attack. Adversaries introduce timing delays or timestamp manipula- tion across multi-agent sensor streams exploiting synchroniza- tion failures, causing agents fusing incompatible observations from different time windows. This creates phantom consen- sus where multiple agents verify contradictory observations, enabling coordinated deception that single-agent validation cannot detect. RMP 33 - Multi-Agent Modality Contradiction Attack. Attackers create strategically-crafted cross-modal contradic- tions exploiting multi-agent consensus mechanisms to am- plify rather than resolve conflicts, poisoning decision-making through adversarial disagreement patterns. Unlike random noise filtered by consensus, these contradictions manipulate voting, auction, or reputation-based coordination. RMP34 - Distributed Memory Poisoning via Perception Corruption. Attackers corrupt perception modules injecting hallucinated facts propagating through validation gates into long-term memory, where multi-agent sharing causes poisoned memories replicating across teams with elevated trust. Dis- tributed memory systems transform single perception errors into persistent, self-reinforcing collective false beliefs. RMP 35 - Vision Model Output Memory Integration Creating Cross-Session Instruction Persistence. Vision model outputs integrated into agent memory persist across sessions as latent backdoor vectors. In multi-agent systems, captions stored in conversation memory can carry dormant malicious instructions that activate when retrieved in future sessions by different agent types. Unlike single-session processing, multi- agent session persistence enables vision-injected instructions to survive indefinitely and activate in completely different agent contexts through memory retrieval. RMP 36 - Multimodal Chunk Poisoning in RAG Vector Stores. RAG chunks combining text with multimodal metadata (image captions, OCR, table data) enable latent instructions to hide in modality gaps that text-only validation misses. Attackers poison chunks so that retrieval for legitimate queries surfaces instructions embedded in the non-text metadata com- ponent, persisting in the vector store and evading standard text-based content analysis. RMP 37 - Audio Transcript Memory Corruption Through Whisper Hallucination Persistence. Speech recognition hallu- cinations integrated into agent memory appear as legitimate transcript content indistinguishable from accurate transcrip- tion, creating backdoor vectors that activate when future agents retrieve similar audio contexts. Multi-agent systems lack cross- agent mechanisms to validate transcripts against source audio, allowing hallucinated instructions to persist and propagate as trusted episodic memory. RMP38 - Chart Linearization DePlot Instruction Injec- tion. DePlot chart-to-table conversion can be exploited by crafting charts whose linearized output contains malicious instructions. In multi-agent extraction pipelines, Agent A performing chart linearization produces output that Agent B interprets for synthesis, with injected instructions materializing only during Agent B’s synthesis step—a vulnerability unique to the extraction/interpretation separation in multi-agent archi- tectures. RMP 39 - HTML Entity Encoding Confusion Across Multi-Agent Parsing. Different agents use heterogeneous HTML parsing methods that decode HTML entities incon- sistently, enabling attackers to craft entities that execute as instructions in agents using full decoders while remaining inert in agents using partial decoders. Multi-agent web pipelines with mixed parser types create conditional instruction execu- tion absent in single-agent monolithic parsing. RMP 310 - CSS Content Injection Through Pseudo- Element Rendering. CSS pseudo-elements create a dual- channel content path where rendering agents display benign visual content while extraction agents processing CSS sep- arately encounter injected instructions. Multi-agent systems where rendering and extraction are handled by different agents enable pseudo-element instructions to execute in the extraction layer without any rendering-visible context. 4) RMP 4 - Framework-Specific Memory Vulnerabilities: RMP41 - Framework-Dependent Memory Architecture Mis- matches Enabling Cross-Framework State Poisoning. Multi- agent systems combining agents built on different frameworks (LangChain, LangGraph, AutoGen, CrewAI, Semantic Kernel) create memory architecture mismatches where transformation between incompatible representations becomes an injection point. Attackers craft memory payloads optimized for the transformation logic rather than for validation, exploiting the semantic gap at framework boundaries that single-framework systems never face. RMP 42 - Framework-Orchestrated Session Resumption Creating Distributed Memory Corruption. Multi-agent systems restoring multiple frameworks’ session state simultaneously create cross-framework propagation paths where corrupted state from one framework’s restored memory affects others through shared context. Unlike single-framework systems with one state persistence model, multi-framework combinations require synchronizing heterogeneous restoration mechanisms, and inconsistencies enable latent backdoors invisible within any single framework. RMP 43 - Checkpoint Persistence Enabling Undetected Backdoor Installation. Attackers who inject malicious instruc- tions into agent state can checkpoint that poisoned state, later resuming to activate dormant instructions after a temporal gap that defeats monitoring expecting immediate manifesta- tion. Multi-agent checkpoints preserve distributed cognitive state across multiple agents, enabling compound backdoor activation when multiple agents simultaneously resume from poisoned checkpoints. RMP 44 - Reducer State History Manipulation as Latent Instruction Persistence. Append-only reducer functions (e.g., add_messages) create permanent cognitive state where early-session injections persist indefinitely in shared message history. Multi-agent shared message history turns reducer append behavior into an unintended cross-agent persistence vector, as injected instructions from one agent’s session remain accessible to all agents iterating on the shared history. RMP 45-ConversationBufferMemoryPoisoning Through Early Session Injection. Early-session injections into ConversationBufferMemory create latent backdoors that activate when specific trigger conditions appear in later interactions. In multi-agent systems sharing conversation memory across specialized agents, backdoors injected into one agent’s context activate in completely different agent types months later—an isolation failure absent in single-agent systems with independent memory contexts. RMP 46 - Agent Scratchpad Poisoning for Latent Rea- soning and Execution History Hijacking. Poisoned scratchpad entries bias subsequent reasoning cycles and fabricate execu- tion histories that cause agents to select tools based on false prior outcomes. Multi-agent systems sharing scratchpad state through session coordination enable cross-agent poisoning where one agent’s compromised reasoning history affects all downstream agents, unlike single-agent systems with isolated execution histories. RMP47 - Memory Key Namespace Collision Enabling Context Injection. Standardizing memory key names (e.g., ”chathistory”) across a multi-agent shared backend cre- ates collective vulnerabilities where injecting malicious con- tent under a shared key poisons all agents referencing that key. Single-agent systems have isolated memory namespaces; multi-agent shared backends frequently neglect namespace isolation for convenience. RMP 48 - Tool Output Integration into Memory Without Sanitization. Tool outputs incorporated directly into agent scratchpads and conversation history without sanitization en- able attackers to return results containing instructions that persist as backdoors. In multi-agent systems, tool output from one agent becomes persistent memory affecting multiple downstream agents, giving poisoned tool results multiplicative reach versus single-agent systems where damage is confined to one context window. RMP49 - Shared Conversation History in AutoGen GroupChat Creating Distributed Memory Poisoning. Auto- Gen’s GroupChat shared message history creates collective cognitive state where poisoning one contribution propagates to all agents throughout the conversation lifecycle. Unlike isolated single-agent memory, a single-point injection into shared GroupChat history achieves synchronized compromise of all participating agents simultaneously. RMP 410 - CrewAI Task Context Persistence Enabling Cross-Task Latent Instruction Propagation. CrewAI’s hier- archical task chaining with context inheritance enables a single early injection to propagate deterministically through all dependent tasks without re-validation. Single-agent tasks operate independently; CrewAI’s context inheritance creates a deterministic propagation path for poisoned context across the full task chain. RMP411 - Manager Decision Memory in CrewAI Hi- erarchies Creating Cross-Worker Context Poisoning. CrewAI managers retaining memory of worker outputs incorporate poisoned patterns into future delegation decisions when worker outputs are compromised. Unlike single-agent systems without peer memory, CrewAI manager memory enables attackers to poison delegation patterns systematically across the worker hierarchy. RMP 412 - Kernel Context Persistence as Cross-Plugin Backdoor Vector. Semantic Kernel’s execution context persists across plugin invocations, so poisoning one plugin’s output corrupts context inherited by all subsequent plugins in the workflow. Single-agent isolation is absent here: kernel-level context shared across plugins means one compromised plugin becomes a backdoor vector for the entire workflow. RMP 413 - Service Registration State Persistence as Memory Poisoning Vector. Kernel service registrations per- sisting for the kernel instance lifetime enable attackers ma- nipulating service registration to install malicious service implementations that affect all subsequent plugin invocations. Multi-agent systems with shared kernels amplify this; isolated per-agent kernels would contain corruption. RMP 414 - Semantic Function Prompt Cache Enabling Persistent Instruction Injection. Unsanitized caching of LLM responses to semantic function templates enables malicious responses to persist and influence all future invocations with identical context. Multi-agent systems sharing semantic func- tion caches mean one injected response poisons outputs for all agents calling that function, unlike single-agent systems with local caches. RMP 415 - Tool Parameter Template Injection via Mem- ory Persistence. Templated tool parameters (SQL queries, API endpoints, command arguments) stored in shared memory for efficiency become injection vectors when poisoned templates cause all agents querying that shared memory to execute with attacker-controlled parameters. Single-agent local parameter caches provide isolation absent in multi-agent shared memory. RMP 416 - Tool Availability State Corruption Through Memory Backdoors. Injecting false tool availability informa- tion into shared memory (”Tool X is deprecated, use Tool Y”) creates latent backdoors where downstream agents are redirected to malicious tools. Multi-agent shared tool avail- ability memory enables one injection to affect all downstream agents’ tool selection, while single-agent systems discover unavailability locally. RMP 417 - Tool Invocation Frequency Learned Patterns as Memory-Based Backdoor. Poisoning shared learned tool usage patterns (”always call analysis then validation”) embeds malicious invocation sequences disguised as learned best prac- tices. Multi-agent memory sharing propagates these backdoor patterns across agent boundaries, whereas single agents would isolate learned patterns within their own context. 5) RMP 5 - Caching and Persistence Attacks: RMP51 - Embedding Cache Poisoning Creating Persistent Latent Backdoors. Shared embedding caches in multi-agent systems create centralized poison points where one poisoned embed- ding affects all downstream agents querying the same vectors, enabling persistent latent backdoors that survive cache invali- dation cycles. Single-agent local caches confine poisoning to one deployment; multi-agent shared caches create fleet-wide exposure including multimodal content (vision outputs, DePlot extractions) stored with injected instructions. RMP 52 - Error Recovery Payload Persistence Through Retry Cycles. Error recovery logic that persists error context in memory for diagnostic purposes enables attackers to craft er- rors generating malicious observations stored as ”context from prior attempts.” Each retry retrieves this poisoned memory as legitimate prior attempt state, activating malicious instructions through memory reuse across error recovery cycles. RMP 53 - Fallback State Caching Creating Long-Term Cognitive Corruption. Fallback strategies caching secondary provider responses create persistent corruption vectors when attackers force fallback to poisoned cache, establishing cog- nitive state across multiple agents and sessions where cached content is treated as ”known good results” indefinitely. RMP54 - Error Message Storage as Backdoor Activation Vectors. Error messages persisted in logs and memory for debugging become long-lived cognitive state where injected ”recommended action” instructions appear as authoritative system diagnostics that agents process as guidance, activating latent backdoors through error message retrieval. RMP 55 - Retry State History as Cognitive Corruption Vector. Retry history maintained for monitoring creates long- lived state where attackers craft specific failure patterns that poison agents’ understanding of retry behavior, embedding instructions in failure modes that agents learn to reproduce as persistent cognitive corruption. RMP 56 - Graceful Degradation Configuration Persis- tence Creating Behavioral Memory Injection. Degradation state that persists across agent interactions creates cognitive state where agents continue executing in degraded mode after recovery. Attackers poisoning degradation configura- tion can permanently disable security capabilities through configuration-driven behavioral persistence. 6) RMP 6 - Streaming and Real-time Processing Attacks: RMP 61 - Streaming Context Accumulation as Persistent Memory Injection Vector. Streaming outputs stored in memory as tokens arrive create injection windows where malicious instructions embedded mid-stream are stored before complete validation completes. In multi-agent session resumption, poi- soned streaming context from one session contaminates all agents accessing shared memory in future sessions, enabling persistent backdoors that batch validation would have caught. RMP 62 - Progressive Disclosure in Streaming Re- sponses Hiding Malicious Memory Persistence. Attackers hide persistence instructions in later-streamed content that appears as auxiliary detail rather than a directive. In multi- agent streaming where memory-writing agents process content incrementally, persistence instructions execute before the full stream is available for validation, and shared memory amplifies the effect to all agents accessing that memory. RMP 63 - Streaming Token Timing for Distributed Mem- ory Corruption. Attackers controlling streaming timing can inject malicious content precisely when distributed multi-agent memory synchronization completes, capturing the injection in synchronized state. Distributed multi-agent memory creates multiple synchronization windows exploitable through stream- ing speed manipulation—a vulnerability absent in centralized single-agent memory. RMP 64 - Conversation History Injection Through Streaming Response Buffering. Streaming handoffs between agents create temporal buffering windows where mid-stream injections are captured in conversation history before the stream completes validation. Multi-agent streaming pipelines have multiple buffering points at handoff boundaries where injections escape validation, unlike single-agent streaming confined to one context. 7) RMP 7 - Evaluation and Metrics Poisoning: RMP71 - Evaluation History Poisoning Through Baseline Persistence and Comparison Manipulation. Shared baseline storage in multi-agent evaluation systems creates single points of failure where poisoning historical baseline metrics causes all down- stream evaluation agents to compare against false reference points. Unlike single-agent systems computing baselines fresh, multi-agent shared baseline caches enable one poisoning to establish persistent long-term evaluation bias across the entire evaluation fleet. RMP 72 - Learned Evaluation Patterns as Latent Back- doors in Adaptive Metrics. Adaptive evaluation metrics learn- ing patterns from prior evaluations embed those patterns in shared agent memory, where injected false priors (e.g., inflated expected accuracy) cause systematic evaluation bias. Multi- agent shared pattern memory propagates backdoored expecta- tions to all agents accessing that memory, turning one injected learned pattern into fleet-wide measurement distortion. RMP 73 - Cached Evaluation Results Poisoning Through Result Deduplication and Replay Attacks. Shared evaluation result caches in multi-agent systems enable attackers to poison cache entries for specific test cases, causing all evaluation agents to retrieve corrupted results simultaneously. Replay attacks substituting historical cached results fabricate current performance for all agents through the shared cache layer without modifying individual test cases. RMP 74 - Evaluation Agent Scratchpad Poisoning En- abling Latent Measurement Bias. Shared evaluation scratch- pads enable attackers to inject false evaluation history (fabri- cated prior test results), which downstream agents treat as es- tablished records to avoid duplicate testing. Multi-agent shared scratchpads propagate false evaluation records to all agents reading shared state, unlike isolated single-agent scratchpads. RMP 75 - Evaluation Dataset Memory Corruption Through Progressive Modification. Evaluation datasets in mu- table multi-agent pipelines with multiple modification agents (preprocessing, augmentation, cleaning) provide cover for progressive corruption through normal operation workflows. Single-agent evaluation with transparent dataset immutability lacks this distributed corruption vector. RMP 76 - Evaluation Session State Persistence Enabling Evaluation Bypass. Persistent evaluation session state across agent resets enables poisoning in early test cases to contami- nate all subsequent evaluations through shared session context, bypassing per-agent isolation assumptions. RMP 77 - Metric Aggregation State Manipulation. Mu- table intermediate aggregation state in centralized multi-agent metric aggregation enables attackers to alter the set of scores used to compute aggregate metrics without modifying in- dividual agent results, corrupting final measurements at the aggregation layer. RMP 78 - Benchmark Performance History as Persistent Cognitive Corruption. Shared performance history repositories in multi-agent systems enable one poisoned success record for a malicious tool to influence all agents querying shared benchmark results, creating pervasive latent backdoors through fabricated historical tool performance. Single-agent local per- formance history contains this within one agent. RMP 79 - Learned Benchmark Artifacts as Persistent Agent Bias. Multi-agent knowledge sharing enables overfitting patterns learned by one agent to propagate to others through shared memory or training data, replicating benchmark- specific biases across agent networks as if they were genuine capabilities. Single-agent overfitting remains contained to that deployment. RMP 710 - Agent Confidence Calibration Degradation Through Benchmarking. Multi-agent confidence propagation enables miscalibration to cascade: agents inherit upstream calibration errors and add their own, progressively detach- ing confidence scores from actual accuracy across the agent chain. Single-agent miscalibration remains isolated; multi- agent propagation creates compound miscalibration that sur- vives indefinitely in system memory. 8) RMP 8 - Parameter Tuning and Configuration Poi- soning: RMP81 - Multi-Modal Web Benchmark Content Injection via Image Metadata. Adversaries embed malicious instructions in image metadata (EXIF, XMP, steganographic content) that vision models extract as legitimate text context. In multi-agent visual pipelines where capture and metadata processing are separated across agents, injected metadata propagates as authoritative extracted content across agent boundaries. RMP 82 - Model-Specific Memory Architecture Tun- ing Creating State Corruption Vectors. Multi-agent systems that swap models during parameter tuning create semantic translation boundaries where state optimized for one model’s representation is misinterpreted by another. Attackers craft state that stores correctly under one model but corrupts during cross-model retrieval—a vulnerability absent in single-agent systems with consistent model-state semantics. RMP 83 - Context Window Memory Truncation as La- tent Instruction Activation. Multi-agent systems with hetero- geneous context window sizes create truncation-point diversity where attackers craft instructions designed to survive specific truncation regimes while other content is discarded. Instruc- tions persist in agents with matching window sizes while being lost in others, creating exploitable inconsistencies invisible to the unified conversation display. RMP 84 - Tuning Dataset Memory Poisoning Through Benchmark Artifacts. Shared tuning datasets in multi-agent systems mean a single dataset poisoning causes all agents tuning on that shared data to memorize adversarial patterns simultaneously. Benchmark artifacts with subtle trigger pat- terns activate malicious behavior when real inputs match those patterns across the entire fleet. RMP 85 - Hyperparameter Persistence as Cognitive State Corruption. Hyperparameter configurations stored in shared backends persist across sessions and are consumed by all agents. Attackers poisoning shared configuration with mali- cious hyperparameter values cause those values to be adopted fleet-wide as apparent tuning results, affecting all agents simultaneously versus single-agent configurations with local scope. RMP 86 - Pareto Frontier Configuration Poisoning Through Baseline Manipulation. Poisoning shared baseline metrics used for Pareto frontier analysis causes inferior or malicious configurations to appear optimal and get selected for production across all agents sharing those baselines. Corrupt- ing the comparison data used for parameter selection ensures poisoned values are permanently adopted as ”optimal” system- wide. 9) RMP 9 - Learning and Training Data Attacks: RMP 91 - Few-Shot CoT Demonstration Injection in Plan- and-Execute Architectures. Poisoned chain-of-thought demon- strations in a planning agent’s few-shot examples teach mali- cious decomposition patterns that execution agents inherit and follow without recognizing the injection. Unlike single-agent CoT injection affecting one reasoning chain, multi-agent Plan- and-Execute injection poisons the planning layer and thereby corrupts all downstream execution workers. RMP 92 - Trajectory Data Injection in Few-Shot Rein- forcement Learning Flywheels. When Agent A’s trajectories become Agent B’s few-shot examples, adversarially injected trajectories that superficially complete tasks while embedding control-flow changes propagate through agent chains. Each downstream agent internalizes and re-teaches the corrupted behavior, compounding the poisoning across the full multi- agent learning flywheel. RMP 93 - Fine-Tuning Data Contamination Through Few-Shot Example Selection. Poisoning the selection heuris- tics of an agent that curates fine-tuning examples causes it to select subtly malicious training data for downstream agents. The attack compounds through learning stages: demonstration poisoning amplifies into fine-tuning contamination, then into behavioral corruption in consuming agents. 10) RMP 10 - Observability and Tracing Attacks: RMP 101 - Trace Timestamp Clock Skew as Causality Corruption Vector. Clock skew across distributed multi-agent systems makes trace causality unreliable, enabling attackers to craft instructions that appear in traces in plausible but false causal orders. Unlike single-agent internal clock skew, cross- system multi-agent traces make true causality verification impossible without cryptographic proof. RMP 102 - Trace Filtering as Selective History Manip- ulation. Attackers poison span metadata in shared multi-agent trace repositories to make critical tool invocations appear as non-error spans that filtering logic removes from oversight views. All agents querying shared traces miss the evidence, whereas single-agent trace analysis is monolithic and does not expose this multi-consumer vulnerability. RMP 103 - Multi-Agent Root Cause Analysis Inference Failures. Multi-agent attack architectures exploit the cognitive difficulty of cross-agent root cause analysis by maximally separating symptom location from cause location. Investigators may correctly identify a proximate agent as the cause while missing an upstream compromise several agents earlier, and attackers can craft false causal trails to reinforce this misdi- rection. RMP 104 - Confidence Score Propagation Poisoning Through Trace Analysis. Multi-agent confidence signals cross- ing agent boundaries enable confidence injection through trace manipulation: a compromised agent reports fabricated high- confidence reasoning, and downstream agents propagate that confidence forward. Unlike single-agent internal confidence propagation, cross-agent confidence signals can be injected through trace manipulation affecting all downstream decision- making. 11) RMP 11 - Learned Behavior and Memory Evolution: RMP 111 - Memory Reduction Exploit Through Halluci- nated Historical Context. Hallucinated tool parameters stored in shared multi-agent memory persist as ”historical evidence,” causing other agents to repeat the hallucination believing it is grounded in prior successful attempts. Single-agent memory contains only that agent’s own history; shared multi-agent memory enables one agent’s hallucinations to corrupt other agents’ decision-making as apparent facts. RMP 112 - Memory Evolution Manipulation Enabling Persistent Instruction Injection. Memory consolidation and deduplication can be exploited so that evolved consolidated memory contains injected instructions disguised as learned patterns. Multi-agent memory evolution aggregates across agents, enabling malicious patterns inserted by one agent to survive consolidation in shared memory and persist as collective learned behavior. 12) RMP 12 - Context and Parameter Consistency: RMP121 - Memory Slice Attack Through Selective History Retrieval. Attackers poison shared memory so that specific malicious memories retrieve for specific agents based on their query patterns, while different agents receive different subsets from the same query. Single-agent retrieval produces consistent results; multi-agent heterogeneous query patterns create targeted poisoning opportunities absent in single-agent systems. RMP 122 - Long-Term Memory Cross-Session Poison- ing in Multi-User Multi-Agent Systems. Long-term memory poisoned in one agent persists across sessions for that user, and multi-agent architectures with shared user memory enable a single compromised agent’s write to affect all agents serv- ing that user in future sessions—broader contamination than single-agent systems with isolated per-user memory. RMP 123 - Poisoned Parameter History in Shared Con- versation Memory. Parameter extraction errors in early con- versation turns persist in shared memory, causing downstream agents to inherit and act on poisoned parameters as ground truth. Single agents can recover through re-extraction; multi- agent shared memory propagates early extraction errors as au- thoritative context that downstream agents cannot distinguish from validated data. RMP 124 - Parameter Accuracy Regression Across Multi-Turn Multi-Agent Sessions. Coherence loss in one agent cascades to dependent agents: Agent A’s coherence failure at turn 5 causes Agent B’s reliability failure at turn 6, Agent C’s at turn 7. Single-agent coherence degradation affects only that agent locally; multi-agent degradation cascades require exponentially more per-agent instrumentation to detect the originating failure point. RMP 125 - Tool Selection Consistency Loss Across Agent Boundaries. Agents selecting semantically different tools for equivalent operations create parameter mismatches when downstream agents assume consistent tool semantics from prior steps. Multi-agent systems require cross-agent tool selection consistency that single agents do not face, and agents cannot detect when an upstream agent switched to a tool with different data semantics. RMP 126 - Parameter Validation State Information Leak- age Through Conversation Memory. Shared multi-agent con- versation memory fails to transfer validation provenance: downstream agents cannot distinguish validated parameters from unvalidated ones because validation context and source provenance disappear across memory boundaries, creating ”blind parameters” treated as validated without any confirma- tion. 13) RMP 13 - Reasoning Transparency and Trust: RMP131 - Reasoning Transparency Weaponization for So- cial Engineering. Explicit reasoning traces create stronger social engineering vectors because users trust transparent logic more than opaque decisions. Attackers inject content crafted to produce chains of reasoning that appear scientifically rigorous while leading to dangerous conclusions. In multi-agent health- care or decision systems, user trust in one agent’s transparent reasoning can override downstream safety mechanisms. RMP 132 - Multi-Agent Reasoning Disagreement Ex- ploitation for Trust Confusion. Singular agents cannot disagree with themselves; multi-agent systems enable attackers to engi- neer disagreement by injecting different payloads to different agents, then manipulating how disagreement is presented to users to steer trust toward malicious recommendations. RMP 133 - Reasoning Confidence Calibration Attacks. Agents expressing inappropriate confidence in injected in- structions make attacks more persuasive to human users. In multi-agent settings, a compromised agent reporting false con- fidence metrics propagates those signals to downstream agents and users, influencing decisions based on injected confidence rather than actual reasoning quality. 14) RMP 14 - Efficiency and Resource Tracking: RMP141 - Efficiency Memory Accumulation Creating Per- sistent Injection Vectors. Poisoned historical efficiency data in shared multi-agent memory causes all agents drawing on that shared history to misallocate resources in subsequent interactions. Single-agent efficiency memory poisoning affects one session; multi-agent shared efficiency memory enables persistent backdoors affecting planning decisions across hours or days of operation. RMP 142 - Conversation History Summarization Lossy Compression as Injection Persistence. Attackers craft ini- tial interactions so that injected instructions survive history summarization compression while benign context is pruned. Multi-agent systems where Agent A’s summarization becomes Agent B’s context input enable tailored injections designed to survive specific compression algorithms, unlike single-agent summarization where the same agent both summarizes and consumes. RMP 143 - Baseline Metric Degradation as Silent Attack Activation. Gradually poisoning shared efficiency baselines forces agents targeting a percentage improvement to execute in resource-constrained paths that activate hidden payloads. Multi-agent shared efficiency baselines mean one poisoning affects all agents’ optimization targets simultaneously across the fleet. RMP 144 - Cost Attribution Memory as Decision Con- text Poisoning. Poisoned cost attribution records in shared multi-agent memory corrupt cost-based orchestration deci- sions, routing work to unintended agents. Single-agent cost tracking is internal; multi-agent shared cost attribution enables one poisoning to affect all downstream selection decisions. RMP 145 - Efficiency Insight Persistence as Learned Backdoor. Attackers craft initial interactions that trigger specific efficiency insights stored as learned policies (e.g., ”skip analysis for Operation X”). Multi-agent systems sharing learned insights enable one agent’s poisoned learning to affect all agents’ subsequent optimization decisions drawn from shared repositories. 15) RMP15 - Vector Database and Embedding Poi- soning: RMP 151 - Embedding Space Poisoning Through Cross-Provider Model Switching. Multi-agent systems using different embedding providers store embeddings with incom- patible semantic spaces in shared vector databases. Attackers craft documents that embed favorably in one provider’s space to achieve high retrieval rank from that provider’s queries while ranking poorly under other providers, exploiting the implicit but false assumption that mixed embeddings in shared stores are semantically comparable. RMP 152 - Cached Embedding Corruption in Shared Vector Stores. Shared embedding caches trusted without integrity validation enable attackers to inject embeddings computed with compromised models or mismatched dimen- sions that appear numerically valid but represent adversarially crafted semantic spaces. Once malicious embeddings enter a shared cache, all agents retrieving from that cache incorporate poisoned vectors into their RAG pipelines invisibly at the vector level. RMP 153 - HNSW Graph Structure Poisoning Through efConstruction Parameter Manipulation During Index Rebuild. Attackers reducing efConstruction during index rebuilds cause poorly-connected HNSW graphs with degraded retrieval qual- ity to be stored as the production index. The resulting graph passes integrity checks but returns suboptimal neighbors for all queries indefinitely until the next rebuild. Multi-agent systems with shared vector databases experience fleet-wide retrieval degradation from one poisoned rebuild. RMP 154 - Persistent Volume Poisoning in Vector Database Storage Layers. Attackers with volume access can directly modify stored HNSW graph files, embedding values, or metadata databases, injecting corrupted data that persists across restarts and affects all agents querying the volume. Un- like in-memory poisoning, volume-level corruption is durable and can substitute attacker content for legitimate documents through altered graph edges, shifted embeddings, or falsified source attribution metadata. RMP 155 - Cluster Replication Protocol Poisoning Prop- agating Corrupted Vectors Across Nodes. Cluster replication protocols that verify format and checksums but not semantic correctness automatically propagate poisoned vectors from one compromised node to all replicas. Once corruption repli- cates, identifying and recovering poisoned embeddings across all nodes is intractable without ground-truth validation sets. Multi-agent systems experience N-way amplification through replication, with the cluster’s high-availability features accel- erating poisoning propagation within seconds. 16) RMP 16 - ETL Pipeline and Data Processing At- tacks: RMP161 - ETL State File Poisoning for Persistent Incremental Update Corruption. Attackers tampering with ETL state file timestamps cause persistent extraction range corrup- tion: backdating forces reprocessing of months of historical data creating duplicate chunks that dilute retrieval precision; advancing timestamps creates permanent knowledge gaps for documents updated in the skipped window. Multi-agent sys- tems with shared state files experience synchronized memory poisoning across all agents simultaneously from one tampering event. RMP 162 - Quality Validation Threshold Degradation Through Incremental Configuration Drift. Incremental thresh- old relaxations each justified individually accumulate over time to allow low-quality fragments into knowledge bases. In multi-agent systems with centralized configuration, each threshold reduction affects all agents’ subsequent ETL runs simultaneously, creating fleet-wide knowledge base quality degradation as low-information fragments crowd out substan- tive documentation. RMP 163 - Chunking Overlap Poisoning Creating Cross- Chunk Context Contamination. Attackers inserting malicious content into chunk overlap regions cause multiple consecutive chunks to carry the poisoning, since overlap content appears verbatim in adjacent chunks. The attack propagates along the chunk chain: each overlap boundary multiplies exposure, maximizing poisoning coverage while embedding malicious instructions within what appears to be legitimate contextual continuity. RMP 164 - Semantic Cache Entry Poisoning Through Adversarial Embedding Injection and Similarity Threshold Exploitation. Attackers optimize adversarial embeddings to simultaneously exceed the cosine similarity threshold for multiple target queries, injecting a single cache entry that poisons responses for all matching legitimate queries. The attack exploits high-dimensional embedding geometry where a carefully positioned adversarial vector can fall within threshold distance of many legitimate query embeddings. RMP 165 - Response Cache Corruption Through Query Normalization Collisions and Cache Key Manipulation. At- tackers exploit text normalization (lowercasing, whitespace collapsing, punctuation removal) to craft queries that produce identical cache keys as legitimate queries, associating mali- cious responses with those keys. Legitimate users issuing the natural-phrasing equivalent then retrieve the poisoned response transparently through the cache hit mechanism. RMP 166 - Quality Threshold Progressive Degradation Through Incremental Configuration Drift and Institutional Memory Loss. Successive threshold relaxations driven by operational pressures accumulate to fundamentally degrade knowledge base quality standards. The degradation appears as a series of individually-justified decisions whose cumula- tive effect—admitting fragments with insufficient context for meaningful retrieval—goes unrecognized until knowledge base quality has substantially declined. RMP 167 - Deduplication Logic Manipulation Through Threshold Tampering and Implementation Backdoors. Reduc- ing fuzzy or semantic deduplication thresholds causes over- deduplication that incorrectly removes unique documents; raising thresholds allows near-duplicates to pollute knowledge bases. Targeted threshold manipulation for specific source sys- tems can systematically suppress content from those sources while leaving others unaffected, creating selective knowledge gaps invisible in aggregate quality metrics. RMP 168 - State File Persistent Poisoning Through Timestamp Backdating Forcing Historical Document Repro- cessing. Backdating ETL state file timestamps forces repro- cessing of large historical document volumes, inserting dupli- cate chunks that dilute retrieval precision across the knowledge base. The duplicate flood persists until the state file is manually corrected, and for large corpora the reprocessing volume can overwhelm vector database capacity with redundant content. RMP 169 - Quality Threshold Configuration Drift Through Incremental Relaxation Accumulating Low-Quality Content. Repeated incremental threshold reductions each jus- tified by specific valid use cases cumulatively degrade overall quality standards, allowing progressively lower-quality content into the knowledge base over months without any single change appearing significant enough to trigger review. RMP1610 - Citation Database Poisoning Through Ma- licious Chunk Injection with Fabricated Source Attributions. Attackers inject malicious chunks with fabricated metadata attributing them to authoritative sources, causing RAG systems to cite dangerous recommendations as originating from trusted authorities. Users seeing authoritative attribution trust the recommendation without verifying chunk content against the actual source document. RMP 1611 - Batch Processing Queue Contamination Through Poisoned Document Injection During Concurrent Processing. Shared batch queues consumed by concurrent multi-agent processors enable poisoned documents injected into a batch to influence batch-level operations (deduplication, quality scoring, embedding) that affect all documents within the same batch, spreading contamination to legitimate docu- ments through processing proximity. RMP 1612 - MinHash Fuzzy Deduplication Hash Col- lision Injection Creating Training Data Duplication Ampli- fication. Adversaries craft documents producing MinHash signatures that collide with legitimate documents, causing deduplication to retain malicious content while discarding authentic documents. In centralized multi-agent NeMo Curator deduplication, a single successful collision enables fleet-wide training data substitution: all agents trained on the shared corpus learn from the adversarial replacement, with semantic threshold exploitation, timestamp-ordering attacks, and hash function concentration attacks creating synchronized adversar- ial biases across the entire agent fleet. 17) Other Risks/Threats/Vulnerabilities Worth Noting: (No additional items were identified as needing separation into this category; all items above are directly relevant to memory poisoning and latent backdoor attacks in AI agents.) E. Non-determinism, continual change, and assurance gaps as a risk surface ”AI Agents Under Threat” and ”Security of AI Agents”emphasizenon-determinismandcontinual change as first-class security concerns for agent systems. [dl.acm](https://dl.acm.org/doi/10.1145/3716628) •Stochastic,path-dependentbehavior:Small changesinprompts,timing,externalcontent,or retrieveddocumentsdramaticallyalteragenttool-use trajectory. Many attacks only execute along particular paths;finitetestingcannotreliablyboundbehavior. [dl.acm](https://dl.acm.org/doi/10.1145/3716628) •Continualupdateswithoutchangecontrol: Vendorsfrequentlyupdatemodelweights,tools, prompts, and policies post-deployment, shifting threat surfacequicklyandinvalidatingpriorevaluations. [blog.virtueai](https://blog.virtueai.com/2025/06/25/the- hidden-dangers-in-your-ai-agent-why-traditional-security- falls-short/) Incomplete evaluation and limited reproducibility are dis- tinct vulnerabilities: attackers systematically search behavior space for untested, exploitable trajectories. 1) RND 1 - UI/Streaming and Real-Time Generation: RND11 - Streaming Response Non-Determinism Defeating Audit Reproducibility. Streaming produces non-deterministic intermediate UI states due to stochastic token sampling, floating-point variance across hardware, and variable network buffering. In multi-agent pipelines, Agent A’s partial output may be consumed by Agent B before safety filtering or gen- eration completes, creating timing-dependent vulnerabilities absent in single-agent systems. Because token sequences and delivery timing differ across executions, audit replay cannot re- liably reproduce the conditions under which malicious behav- ior occurred, allowing attackers to design attacks that succeed non-deterministically in production but fail deterministically in testing. [?] [?] [?] [?] [?] RND 12 - Streaming Latency Non-Determinism En- abling Temporal Exploitation. Streaming latency varies unpre- dictably via network conditions, computational load, and token generation speed. In multi-agent systems, latency variability across N agents and M connections produces combinatorially many execution orderings, enabling attackers to force specific agent-state combinations through cache manipulation, request ordering, or load induction. Timing side-channels allow net- work adversaries to infer execution state, and conditional malicious behaviors (sleeper agents) can be activated only under production-specific latency conditions that controlled testing environments never replicate. [?] [?] [?] [?] [?] [?] [?] RND 13-StreamingTokenSamplingCreating Ephemeral Vulnerability Windows. Stochastic sampling parameters (temperature, top-k, top-p) cause identical inputs to produce different token sequences across executions, creating ephemeral windows where malicious content appears transiently before safety filtering can act. Multi-agent systems amplify this: Agent A’s probabilistically malicious output conditions Agent B’s input, cascading non-determinism through the pipeline in ways untestable without a live multi-agent setup. Attackers with model access can probe the sampling parameter space to maximize the probability of harmful token sequences, while the attack remains invisible in deterministic test configurations. [?] [?] [?] RND 14 - Inline Suggestion Real-Time Generation Cre- ating Ephemeral Malicious Content. Inline code suggestion systems generate context-aware completions asynchronously, creating race-condition windows where generation agents pro- duce suggestions that users see before safety agents finish filtering. Non-deterministic token sampling means malicious suggestions may appear probabilistically across multiple at- tempts, while unaccepted suggestions are typically unlogged, creating monitoring blind spots absent in non-streaming archi- tectures. The multi-agent race between generation and filtering is structurally harder to close in distributed pipelines than in single-agent systems. [?] [?] [?] 2) RND 2 - Progressive Disclosure and Error Han- dling: RND 21 - Progressive Disclosure State Transitions as Untestable Attack Surface. Progressive disclosure (essential, expanded, technical layers) creates exponentially complex state spaces. Attacks embedding malicious instructions in technical layers of Agent A while displaying benign content in Agent B manifest vulnerabilities only with specific disclosure combinations. State combinations grow exponentially with agent count, making exhaustive validation impossible. RND 22 - Error Message Progressive Disclosure Hiding Attack Pattern Evidence. Progressive error disclosure creates forensic blind spots where critical attack evidence resides in unexpanded technical layers that analysts rarely examine. In multi-agent systems, attackers selectively trigger errors in low- priority background agents whose collapsed-by-default display hides malicious activity, while high-visibility agents remain benign. Unlike single-agent systems, multi-agent error chains introduce O(2ˆNM) attribution complexity, enabling causality obfuscation and deliberate error-message mimicry that makes malicious errors indistinguishable from benign system failures. [?] [?] [?] RND 23 - Streaming Error Handling Creating Ephemeral State Non-Determinism. Errors in streaming pipelines appear and disappear as streams progress, making their visibility contingent on the exact timing of observation. In multi- agent architectures, downstream agents may recover or mask upstream errors before they propagate, producing inconsis- tent error detection across replayed scenarios and defeating forensic reconstruction. This non-determinism is structurally distinct from single-agent error handling because multi-agent cascades (Agent A errors, Agent B recovers, Agent C con- sumes) create variable error-visibility paths that cannot be exhaustively tested. [?] [?] [?] [?] [?] [?] [?] [?] 3) RND 3 - Context, Persistence, and Session Manage- ment: RND31 - Session State Non-Determinism Breaking Multi-Turn Attack Detection. Long-lived session context cre- ates an attack surface where adversaries distribute malicious intent across multiple conversation turns, with no single turn triggering stateless safety classifiers. In multi-agent deploy- ments, malicious content injected into one agent’s memory propagates through shared memory stores to other agents in later interactions (contagious jailbreaks), and stochastic execution paths (sampling variance, RAG retrieval random- ness, tool-selection variability) prevent reliable audit replay. This compound non-determinism is qualitatively worse than in single-agent systems because cross-agent memory syn- chronization gaps mean that the same injected payload can manifest differently depending on which agent retrieves it and when. Empirically, multi-turn attacks achieve 80–95%+ success against leading safety-aligned models while enterprise guardrails reach only 0.11–0.40 recall on such attacks. [?] [?] [?] [?] [?] [?] [?] RND 32 - Session Persistence Across UI State Changes Creating Stale Security Context. Context persistence across reloads and navigation creates vulnerabilities where stale security context influences current decisions without user awareness. Multi-agent systems where agents access state at different times with different freshness create inconsistent security postures. Agent A uses cached context from 2 hours ago while Agent B retrieves fresh context, creating divergent trust models. 4) RND 4 - Multi-Agent Coordination and Decision- Making: RND41 - Chat Interface Streaming Attribution Confusion in Multi-Turn Attacks. Chat interfaces displaying streaming responses from multiple agents in unified threads create attribution confusion where users cannot reliably de- termine content sources. Attackers exploit this: Agent A streams benign analysis while Agent B simultaneously streams malicious instructions styled as Agent A’s output, exploiting users’ cognitive limitations tracking concurrent streams. RND 42 - Command Palette Context Prediction Non- Determinism Enabling Inconsistent Guardrails. Command palettes using AI for contextually relevant action prediction create non-deterministic suggestion lists. Multi-agent systems aggregating predictions produce different outputs despite iden- tical starting states, shifting which commands appear at what priority and defeating evaluations that assume dangerous com- mands will never surface without warnings. RND 43 - Approval Workflow Confidence Score Non-Determinism Defeating Threshold-Based Controls. Ap- proval workflows displaying confidence scores exhibit non- deterministic variation across nominally identical decisions. Multi-agent confidence aggregation with distributed compu- tations introduces non-determinism despite identical input, allowing attackers to submit identical requests until non- deterministic variation produces high scores that trigger auto- approval. RND 44 - Multi-Agent Dashboard Real-Time State Up- dates Creating Race Condition Attack Windows. Multi-agent dashboards displaying real-time updates create race condition vulnerabilities where UI state temporarily reflects inconsistent agent combinations. Attackers exploit races crafting inputs causing malicious operations during brief periods when dash- boards display misleading ”safe” indicators. 5) RND 5 - Retry, Resilience, and Error Recovery: RND51 - Auto-Retry Error Recovery Creating Hidden At- tack Amplification Loops. Error patterns implementing auto- matic retry hide attack attempts in collapsed error logs, cre- ating blind spots where malicious operations execute multiple times. Multi-agent error recovery involves distributed retry logic where attackers craft inputs appearing as transient errors while carrying malicious payloads executed during retries. Non-deterministic retry timing defeats evaluations. RND52 - Retry Timing Non-Determinism Defeating Audit Reproducibility. Exponential backoff with jitter cre- ates non-deterministic retry timing making identical scenarios produce different retry patterns. Multi-agent distributed retry agents create variable timing due to network latency and processing speed. Attacks exploiting retry timing variations evade detection—malicious behavior triggered only on specific retry numbers remains undetected. RND 53 - Non-Idempotent Operation Exploitation via Coordinated Retry Storms. Multiple agents coordinate trigger- ing non-idempotent operations through simultaneous retries. Agent A induces transient failures while Agent B floods with retry attempts, causing duplicate financial transactions or resource allocations. Multi-agent amplification occurs when agents optimize timing windows. RND54 - Fallback Route Selection Non-Determinism Creating Untestable Branching. Fallback strategies use prob- abilistic selection (weighted by provider availability, cost, latency) creating non-deterministic routing. Testing cannot establish that malicious fallback routes are prevented because non-determinism enables untested routes appearing. RND 55 - Circuit Breaker Opening Threshold Non- Determinism. Circuit breaker decisions based on rolling failure rate windows create non-determinism where identical failure patterns trigger opening at different times. Multi-agent systems with multiple independent circuit breakers experience variable opening timing. RND 56 - Error Recovery Continuation Conditions Cre- ating Untestable Non-Determinism. Graceful degradation de- cisions about reduced-capability operation involve probabilis- tic thresholds creating non-determinism. Multi-agent systems make independent degradation decisions creating inconsistent degradation states. 6) RND 6 - Checkpoint, State, and Recovery Manage- ment: RND 61 - Checkpoint Replay Poisoning Through State Manipulation. Adversarial agents manipulate check- pointed state during capture-to-resumption windows, inject- ing malicious payloads. Agent A creates partial transactions checkpointing intermediate states while Agent B corrupts checkpoint stores with semantically valid but logically poi- soned data. Orchestrators resuming from compromised check- points propagate attacker-controlled state. RND62 - Determinism Violation Amplification via Cascading State Divergence. Malicious agents exploit non- deterministic replay logic creating divergent state interpreta- tions. Agent A triggers error recovery with carefully crafted inputs producing different replay outcomes from timestamp dependencies. Agent B monitors divergence, submitting con- flicting transactions to system partitions. RND 63 - Retry Logic Exhaustion Through Adversarial Error Injection. Coordinated agents strategically inject recov- erable errors forcing exponential retry backoff, consuming resources while masking critical failures. Agent A crafts inputs triggering edge cases in error classification causing transient failures. Multi-agent coordination enables distributed exhaustion attacks where no single agent appears malicious. 7) RND 7 - Tool Integration and API Management: RND71 - Tool API Drift and Silent Failure Propagation in Multi-Agent Chains. Plan-and-Execute architectures face API version drift creating cascading silent failures. When Agent A calls updated APIs silently changing response format, Agent B consuming output operates on corrupted data unaware. Assurance gaps widen through dependency chain opacity. RND 72 - Tool Schema Version Drift Across Agent Implementations. Tool schemas evolve as capabilities add or deprecate. Multi-agent systems may have agents using different schema versions simultaneously. Agent A expecting [x, y] invokes tools with [x, y, z] from newer schema. RND 73 - Function Calling Model Updates Creating Behavioral Discontinuity. LLM providers periodically update function calling behavior. Multi-agent systems using different LLM versions experience different function calling behavior. Agent A (GPT-4) generates function calls differently than Agent B (Claude). RND 74 - Tool Availability Changes Creating Non- Deterministic Behavior. Tools deprecate and capabilities change. Multi-agent systems have agents using outdated tool lists while others use updated lists. Older agents invoke deprecated tools; newer agents skip tools older agents depend on. RND 75 - Function Calling Parameter Type Changes Creating Silent Failures. Tool parameter types evolve (string to float, adding required parameters). Multi-agent systems with agents trained on different definitions experience silent failures. Agent A generates parameters expecting old schema; tools receive unexpected types. RND 76 - Few-Shot API Calling Example Poisoning in Tool Chains. Tool schemas include API calling examples. Adversaries poison examples with subtle parameter modifi- cations. Agents learning from examples implement unsafe defaults, creating distributed vulnerabilities. RND 77 - Demonstration-Driven Fallback Behavior In- jection. Fallback tool descriptions include examples showing triggering conditions. Adversaries poison fallback examples to trigger under benign conditions, routing agents to compro- mised implementations. 8) RND8-FrameworkandArchitectureNon- Determinism: RND 81 - Combinatorial Non-Determinism in Multi-Pattern Agent Compositions. Production systems combine multiple patterns (ReAct + Plan-and-Execute + Reflection), creating emergent non-deterministic behaviors exceeding individual uncertainties. Given N agents each employing M reasoning steps with K possible tool choices and R reflection iterations, total state space approaches (KˆM)ˆN * RˆN, making exhaustive testing intractable. Emergent hallucinations arise from probabilistic interactions across boundaries rather than single failures. RND 82 - Framework Non-Determinism Enabling Untestable Multi-Agent Attack Surfaces. Different frameworks introduce non-determinism (LangChain temperature, Lang- Graph reducers, AutoGen randomness). Multi-agent systems combining frameworks create multiplicative non-determinism. An attack succeeding through LangChain tool selection trig- gering LangGraph edge randomness represents (kˆm)ˆn behav- ioral space making comprehensive testing infeasible. RND 83 - Continual Framework Updates Invalidating Multi-Agent Security Assurance. Framework vendors contin- uously update model weights, prompts, and routing logic. Multi-agent systems require re-evaluating every combination when any framework updates; N(N-1)/2 combinations make comprehensive re-testing prohibitive. RND84 - Framework Update Invalidating Streaming Security Assumptions. Streaming implementations update reg- ularly, changing buffering, timing, and error handling. Multi- agent systems combining frameworks multiply update im- pact—each framework update shifts behavior. 9) RND9-LangChain/LangGraphSpecificNon- Determinism: RND 91 - Non-Deterministic Conditional Edge Evaluation Creating Untestable Routing. Conditional edge functions exhibit non-determinism when depending on external factors (current time, random sampling, cache state). Multi-agent conditional edges create compounded non-determinism—Agent A’s routing depends on Agent B’s non-deterministic contribution. RND 92 - Reducer Behavior Divergence Across Agent Updates. Multiple agents updating same state field with differ- ent reducer expectations exhibit divergence. Agent A expects add_messages append while Agent B expects overwrite. RND 93 - Checkpoint Restoration Non-Determinism in Replaying Cyclic Workflows. Replaying workflows from checkpoints with cycles containing non-deterministic elements creates divergent paths. Multi-agent cycles compound non- determinism where each agent’s probabilistic behavior inter- acts. RND 94 - Confidence Score Non-Determinism in Tool Selection. LLM agents use language models exhibiting non- deterministic output, causing tool selection confidence to vary. When confidence drops unpredictably, safety gates fail in- termittently. Attackers probe for non-deterministic windows where normally-prevented tools become available. RND 95 - Memory Update Non-Determinism Causing Unpredictable State Evolution. LangChain memory updates exhibit ordering dependencies in distributed systems. Multi- agent memory sharing introduces race conditions from con- current updates where attackers exploit timing. RND 96 - Model Version Updates Invalidating Security Evaluations. LangChain agents update underlying models reg- ularly. Multi-agent systems updating shared instances invali- date evaluations across all agents. RND 97 - Tool API Compatibility Drift Creating Untestable Behavior. External tool APIs evolve; agents may fail adapting. Non-deterministic error handling creates sce- narios where API compatibility failures trigger unpredictable behaviors. 10) RND10 - AutoGen Specific Non-Determinism: RND101 - AutoGen Conversation Non-Determinism De- feating Reproducible Security Testing. AutoGen’s message- driven architecture with stochastic LLM generation produces different flows across identical inputs. Security testing cannot establish unreachability of dangerous paths. Attacks succeed- ing in 0.1% of executions evade validation. RND 102-GroupChatSpeakerSelectionNon- Determinism Creating Untestable Attack Windows. AutoGen’s intelligent speaker selection introduces non-determinism wheremaliciousagentsareselectedprobabilistically. Attackers craft scenarios where they’re selected with exploitable certainty. RND103 - Multi-Agent Framework Update Non- Determinism Invalidating Cumulative Assurance. AutoGen, CrewAI, and underlying LLMs update regularly. Evaluating N agents across M framework versions across P LLM versions creates infeasible re-testing. 11) RND 11 - CrewAI Specific Non-Determinism: RND 111 - CrewAI Hierarchical Task Routing Non- Determinism Enabling Unpredictable Delegation. CrewAI’s manager-based delegation may use probabilistic routing se- lecting workers. Identical delegations route differently across executions. Attacks succeeding when routed to compromised workers fail with legitimate workers. 12) RND 12-SemanticKernelSpecificNon- Determinism: RND121 - LLM-Driven Function Routing Non-Determinism Defeating Audit Reproducibility. Semantic Kernel’s dynamic plugin routing through LLM-driven function calling produces non-deterministic paths. Evaluations verifying ”never invokes dangerous plugins” become invalid. RND 122 - Plugin Registry State Changes Invalidating Prior Evaluations. Semantic Kernel dynamically discovers and registers plugins. Registry changes modify routing without code changes, invalidating evaluations. RND 123 - FunctionChoiceBehavior Configuration Drift Across Agent Updates. FunctionChoiceBehavior settings (Auto/Required/Filtered)determineroutingconsistency. Agents with different configurations produce different routes. RND 124 - Service Registration Lifecycle Enabling State Inconsistency. Kernel service registration is dynamic. Concur- rent agents may observe different service sets if registration changes during execution. 13) RND13 - Multimodal and Vision-Language Models: RND131 - Multimodal Model Version Drift Creating In- consistent Behavior Across Agents. Multimodal RAG using diverse vision models creates complexity. Asynchronous up- dates cause non-determinism. Agent A using CLIP v1.0 and Agent B using CLIP v2.0 produce inconsistent results from shared storage. RND 132 - Vision Model Output Format Inconsistency Across Agents. Different vision models produce different for- mats (NeVA generates captions, DePlot produces tables, CLIP produces embeddings). Multi-agent systems with different outputs create processing ambiguities. RND133 - Whisper Model Update Drift in Audio Processing. Whisper updates change transcription behavior, hallucination patterns, accuracy. Audio agents updating asyn- chronously from dependent synthesis agents create behavior divergence. RND 134 - Embedding Model Quantization Inconsis- tency in Multi-Agent Deployments. Embeddings quantized differently (FP32, FP16, INT8) across agents affect similarity thresholds. Agent A’s INT8 embeddings produce different retrieval rankings than Agent B’s FP32 embeddings. RND 135 - Temperature Variation in Vision-Language Model Output. Vision-language models use temperature con- trolling variability. Multi-agent systems with different temper- atures produce different outputs from identical images. 14) RND14 - Evaluation, Testing, and Benchmark- ing Non-Determinism:RND141 - Non-Deterministic Evaluation Results Defeating Regression Testing. Evalua- tion pipelines with stochastic components produce non- deterministic results. Multi-agent evaluation compounds when multiple agents’ stochasticity interact. Identical versions pro- duce different results, making regression detection impossible. RND 142 - Model Update Invalidating Evaluation Metric Baselines. Evaluation metric models update, changing metric behavior. Multi-agent systems with specialized metric agents experience independent updates shifting baselines. RND 143 - Evaluation Pipeline Component Drift Through Continual Updates. Multi-stage evaluation pipelines have components updating independently. Component drift creates inconsistency making results non-reproducible. RND 144 - Stochastic Test Case Selection Creating Non- Deterministic Coverage. Evaluation pipelines selecting test cases stochastically create non-deterministic coverage. Multi- agent evaluation with independent sampling produces different test subsets. RND 145 - Framework-Dependent Evaluation Behavior Creating Multi-Framework Incomparability. Evaluation agents on different frameworks exhibit different behavior. Same met- rics computed differently produce incomparable results. RND 146 - Non-Deterministic Benchmark Results Pre- venting Reliable Capacity Assessment. Multiple trials with different random seeds required for statistical validity. Multi- agent compounding: Agent A varies 15%, Agent B varies 20%, combined varies 30%+. Attackers exploit non-determinism engineering inputs with unpredictable behavior. RND 147 - Statistical Significance Thresholds Becoming Meaningless in Multi-Agent Contexts. N significance tests across N agents create multiple comparison problems; p ¡ 0.05 becomes unreliable. Attackers exploit artifacts passing N tests through random chance. RND 148 - Model Update Proliferation Creating Assur- ance Gaps. Heterogeneous update schedules create assurance gaps. Agents operate at different capability levels. Vulnerabil- ities fixed in Agent A remain in out-of-date Agent B. 15) RND 15 - Temperature and Sampling Parameters: RND151 - Parameter Tuning Non-Determinism Creating Unpredictable Agent Behavior. Temperature and sampling in- troduce stochasticity with different agents exhibiting different non-determinism levels (0.0 deterministic, 0.7 high variance). Multi-agent tuning compounds across chains where Agent A’s variable outputs become Agent B’s inputs. RND152 - Continuous Parameter Re-tuning as As- surance Gap. Parameter re-tuning happens continuously in production. Each cycle potentially introduces vulnerabilities. Multi-agent continuous re-tuning creates moving-target secu- rity. RND 153 - Cross-Agent Parameter Drift Creating Incon- sistent Security Posture. Parameters drift through independent tuning cycles. Agent A at T1 differs from Agent B at T2. One agent strict (temperature 0.2) rejects injections; peer accepts (temperature 0.5). 16) RND16 - Parameter Extraction and Tool Calling: RND161 - Stochastic Parameter Generation Drift Creating Hallucination Windows. Agents generate parameters stochas- tically. Agent A high temperature (high entropy) vs Agent B low temperature (low hallucination) creates targeted vulnera- bilities. RND 162 - Tool Documentation Drift Across Agent Training Cycles. Agents update continuously. Tool specs change between cycles. Agent A operates on spec v1 while Agent B operates on spec v2. RND 163 - Probabilistic Tool Selection Creating Ad- versarial Search Space. Tool selection uses soft attention (probabilistic). Identical requests select different tools. At- tackers craft ambiguous requests maximizing malicious tool probability. RND 164 - Non-Deterministic Fallback Ordering Creat- ing Unpredictable Attack Surfaces. Fallback chains select next tool probabilistically. Attackers craft inputs where fallback chains include malicious tools. RND 165 - Continuous Hallucination Rate Regression Through Updates. Agent updates through fine-tuning regress unpredictably. Agent A improves hallucination rates; Agent B regresses. Grounding checks calibrated to older rates become ineffective. RND 166-Non-DeterministicParameter ExtractionCausingInconsistency.Agentmodelsuse temperature/sampling affecting inference. Agent A extracts value A in one run, B in another. Multi-agent multiplies: ±2% variance in A and ±2% in B creates ±4% downstream. RND 167 - Tool Selection Variance Creating Reliability Gaps. Tool selection accuracy varies. Agent A selects Tool1 or Tool2 probabilistically. Agent B cannot reliably coordinate expecting specific tool semantics. RND168-TrajectoryVarianceCreatingNon- Deterministic Execution Paths. Trajectory variance means different runs produce different action sequences. Agent A’s varying outputs cause Agent B to receive different input contexts. RND 169 - Parameter Accuracy Variance Across Tem- perature Settings. Parameter extraction accuracy metrics be- come temperature-dependent. Agent A (0.3) achieves 95% accuracy; Agent B (0.7) achieves 78%. 17) RND 17 - Retrieval-Augmented Generation (RAG) and Multi-Hop QA: RND 171 - Ranking Model Manip- ulation Through Relevance Score Injection. Multi-hop re- trieval uses ranking models ordering documents. Adversaries craft high-relevance documents. Multi-agent retrieve-then- synthesize where ranking guides multiple downstream agents amplifies poisoning. RND 172 - Semantic Similarity Exploitation in Dense Retrieval for Multi-Hop Chains. Dense retrievers use em- bedding similarity. Adversaries craft documents semantically similar to queries containing instructions. Multi-agent multi- hop where step N+1’s query derives from step N’s results enables instruction injection. RND 173 - Query Reformulation Instruction Injection in Multi-Hop Retrieval. Multi-hop systems reformulate ques- tions automatically. Attackers inject instructions into source documents becoming sub-queries. Agent A extraction creates instructions Agent B uses. RND174 - Evidence Document Hallucination in Multi- Hop Reasoning Bridge Attacks. Bridge-type questions require identifying intermediate entities. Attackers inject fake bridging documents. Multi-agent systems treat as valid bridges. RND175 - Evidence Grounding Failures as RAG At- tack Surface. Agents reasoning about documents with weak evidence grounding enable injection. ”Document states X, therefore Y” without verification enables poisoning. Agent B cannot validate authenticity, trusts Agent A. RND 176 - Source Attribution Reasoning Confusion. Agents reasoning about which sources support which claims with weak attribution become vulnerable. Multi-agent aggre- gating across sources enables confusion propagating through agents. RND 177 - Hallucination Blindness in Knowledge Graphs. Knowledge extraction hallucinating relationships without verification. Agent A extracts creating entries, Agent B queries. Hallucinated relationships corrupt knowledge. 18) RND 18 - Infrastructure and Deployment Non- Determinism: RND181 - Event Delivery Guarantee Down- grade Attacks via Infrastructure Resource Exhaustion. Multi- agent event-driven systems rely on infrastructure delivery guar- antees. Attackers exhaust resources forcing silent degradation from exactly-once to at-most-once or at-least-once seman- tics, corrupting payment or coordination logic that assumes stronger guarantees. RND 182 - Swarm Consensus Manipulation via Strategic Byzantine Agent Injection at Critical Density Thresholds. Swarm coordination has sharp phase transition thresholds where Byzantine agent density just below detection triggers emergent failures. Attackers inject agents at sub-detection den- sities to cause consensus failures invisible to threshold-based monitoring, with the multi-agent dynamic creating correlated failure modes absent in single-agent deployments. RND 183 - Message Queue Ordering Guarantees as Assurance Gap Under Scaling. RabbitMQ provides per-queue ordering but not cross-queue. Scaling adds queues; agents lose assurance. Multi-agent systems distributing work lose guarantees as systems scale. RND 184 - Vector Database Index Staleness as Run- time Assurance Gap. Vector database indexes become stale during updates. Agents relying on fresh RAG results suffer gaps—results appearing recent actually reflect outdated corpus state. Multi-agent systems with shared vector database face collective staleness where index update status is invisible to individual agents. RND 185 - Prometheus Scrape Interval Variance as Observability Assurance Gap. Prometheus scraping is asyn- chronous with configurable intervals. Agents consuming met- rics face gaps—metrics appear recent but could be 30+ sec- onds old. Multi-agent chains have compounded latency where Agent A’s metric triggers Agent B decision at second-hand lag. RND 186 - API Gateway Canary Deployment Assurance Gaps. Kong canary deployments route percentage of traffic to new versions, creating gaps where agents running new versions make decisions based on infrastructure still running old versions. Multi-agent systems experience ecosystem gaps where v2.0 agents invoking v1.0 tools create format mismatch. RND 187 - MLflow Version Mismatch Assurance Gap During Rollouts. MLflow deployments proceed at different times for different agents. Agent A on v2.5, Agent B still on v2.3. Shared data structures create gaps where Agent A expects v2.5 format but Agent B provides v2.3. 19) RND 19 - Kubernetes and Container Orchestration: RND191 - Horizontal Pod Autoscaler Scaling Behavior Non-Determinism. HPA metrics collection and scaling deci- sions exhibit timing variability. During scaling events, replica counts are non-deterministic. Multi-agent HPA-driven scaling creates non-deterministic agent population changes. RND 192 - StatefulSet Ordinal Initialization Races Dur- ing Restart. StatefulSets initialize pods sequentially but net- work races during restarts create non-determinism. Coordi- nated StatefulSet agents may initialize in non-deterministic order despite sequential specification. RND193 - Network Topology Changes From Node Au- toscaling. Kubernetes node autoscaling can add/remove nodes, changing topology and pod placement. Multi-agent system network topology becomes non-deterministic as autoscaling changes co-location. RND 194 - Kubernetes Scheduler Indeterminism Cre- ating Non-Reproducible Pod Placement. Kubernetes sched- uler places pods based on resource availability and affinity rules, breaking ties non-deterministically. Attackers exploit indeterminism placing malicious agents on specific nodes. Un- like singular deployments, multi-agent scheduler randomiza- tion creates attack surfaces where specific placements enable compromise only intermittently, making validation impossible under rare scheduling conditions. 20) RND 20 - Deployment and Inference Infrastructure: RND201 - Container Image Drift in Continuous Deploy- ment. Canary deployments progressively roll out container images without strict pinning, creating version skew. Multi- agent systems where different agents deploy on different schedules create system-wide version skew. RND 202 - Non-Deterministic Traffic Splitting Across Agent Versions. Canary traffic splitting uses random sampling creating non-deterministic behavior. Multi-agent systems with N agents undergoing canary simultaneously create 2ˆN possi- ble state combinations. RND 203 - Asynchronous Event Processing Creating Ordering Non-Determinism. Event-driven multi-agent systems process events asynchronously. Agents receiving the same events in different orders produce different results. RND 204 - Unobservable State Transitions During Rolling Deployments. Rolling Kubernetes deployments re- place pods gradually. Multi-agent rolling across N services simultaneously create N×(N-1)/2 compatibility combinations. RND205 - Checkpoint Resume Non-Determinism in Serverless Workflows. Serverless workflows resuming from checkpoints may pick up non-deterministically if multiple agents race. Different agents resuming at different times may have different state. RND 206 - Rolling Update Non-Determinism in Version Transitions. Kubernetes rolling updates gradually replace ver- sions. Multi-agent systems experience heterogeneous behavior where Agent A v1 expects specific Tool Interface from Agent B v2 with different interface. RND 207 - Traffic Splitting and Canary Deployment Non-Determinism. Service mesh canaries gradually shift traffic. Multi-agent canary deployments create emergent gaps—some agents interact with Tool API v1, others with v2. 21) RND 21 - Inference Hardware and Optimization: RND211 - Quantization Granularity Non-Determinism in Distributed Inference. Different agents might use different quantization modes (approval agent per-tensor, execution agent per-token). This inconsistency creates non-determinism where same input produces different behavior across agents. RND 212 - Kernel Fusion Non-Determinism From GPU Scheduler Variance. Kernel fusion combines operations, but execution order depends on GPU scheduler decisions varying based on load. Same fused kernel executes with different or- derings across different GPUs. Multi-agent tensor parallelism across different GPUs creates N different scheduler states. RND 213 - Non-Deterministic Token Generation Across NIM Replicas Enabling Probability-Based Attacks. NIM repli- cas executing the same prompt on different GPUs with floating-point rounding differences produce slightly different token probabilities. Attackers craft prompts where specific multi-agent paths activate only under certain probability distri- butions. Multi-agent load balancing creates exploitable prob- ability surfaces. RND 214 - Dynamic Batching Indeterminism Creat- ing Non-Reproducible Agent Behavior. Triton’s dynamic batching depends on request arrival timing, varying non- deterministically. Identical requests submitted at different times produce different batches and inference results. Multi- agent systems where Agent A’s output depends non- deterministically on arrival timing relative to other agents creates non-deterministic surfaces. RND 215 - Continuous Model Updates Creating Per- petual Assurance Gaps in Multi-Agent Deployments. Con- tinuous update systems create non-determinism through zero- downtime version transitions where v2 vulnerabilities enable cross-version attacks, perpetual instability from automated rollouts without stable baselines, and asynchronous propaga- tion creating windows where identical inputs produce different outputs depending on update status. Multi-agent continuous updates create unbounded assurance surfaces where formal verification cannot complete before the next update. RND 216 - Hardware-Specific TensorRT Engine Varia- tions Creating Deployment Assurance Gaps. TensorRT engines are GPU-architecture specific. Fleet Command deployments across legacy and modern hardware create heterogeneous agent populations with different inference behaviors. Testing on development hardware (RTX 4090) doesn’t match produc- tion (A100). 22) RND 22 - Optimization and Efficiency: RND221 - Profiling-Induced Non-Determinism as Assurance Viola- tion. Profiling adds measurement overhead creating non- determinism not present in baseline execution. Multi-agent systems with optimization decisions based on profiling data create distributed non-determinism. RND 222 - Temperature and Sampling Parameter Vari- ability Across Optimization Cycles. Configuration optimiza- tion adjusts sampling parameters creating non-determinism. Different agents might receive different optimized parameters, creating behavioral divergence. RND 223 - Asynchronous Configuration Updates During Multi-Agent Coordination. Configuration optimization hap- pens asynchronously. Agent A operates on old configuration while Agent B operates on new. RND 224 - Speculative Decoding Acceptance Rate Vari- ability. Speculative decoding acceptance rates vary based on input characteristics. These variable rates create non- deterministic latency and output distributions not observable with fixed test sets. 23) RND 23 - Chain-of-Thought (CoT), Tree-of-Thought (ToT), and Reasoning Non-Determinism: RND231 - CoT path explosion in multi-agent coordination. Multiple agents generating different CoT chains for the same problem create exponential execution paths. Each agent’s reasoning choices affect other agents’ available paths. Red-teaming cannot cover the space. RND 232 - Reasoning consistency drift across agents. As agents update individually, their reasoning patterns diverge. A poisoning attack exploiting old patterns may fail on updated agents. RND 233 - Temporal coordination non-determinism. Agents coordinating through shared CoT traces create race conditions. Agent A’s reasoning might be incomplete when Agent B retrieves it. RND234 - Stochastic multi-agent planning creating untestable paths. Each agent’s stochastic reasoning choices combine multiplicatively. Testing single agent CoT space is feasible; testing combined space is computationally infeasible. RND 235 - Backtracking state divergence in distributed ToT systems. When agents maintain separate search trees and backtrack concurrently, timing differences cause divergence on which branches have been explored. 24) RND24 - Self-Consistency and Multiple Reasoning Paths: RND 241 - Stochastic Sampling Non-Determinism as Assurance Gap. Self-Consistency uses stochastic decoding cre- ating ”k different reasoning approaches” intentionally, creating assurance gaps—identical input produces variable outputs. In multi-agent systems where deterministic behavior is assumed, Self-Consistency’s non-determinism becomes a liability. Test- ing cannot comprehensively cover stochastic behavior space. RND242 - Temperature Tuning Parameter Drift as Runtime Assurance Gap. Self-Consistency temperature tuning affects behavior and is often tuned for specific problem classes. In multi-agent systems where temperature is shared, parameter drift affects all agents simultaneously. RND243 - Continual Sampling Parameter Optimization Creating Adversarial Drift. Continuous optimization adjusting sampling parameters based on success rates causes systematic drift. In multi-agent systems with shared optimization, drift affects all agents. RND 244 - Context Window Non-Determinism From Compression Algorithms. Self-Consistency with k=40 paths creates large context; compression algorithms may non- deterministically select which information survives. Multi- agent handoffs between agents with different context windows face compression non-determinism. 25) RND 25 - Hierarchical Task Network (HTN) Planning Non-Determinism: RND251 - Probabilistic Decomposition Method Selection Creating Assurance Gaps. LLM-based HTN planners select methods stochastically. The same goal might decompose via method M1 (probability 0.7) and method M2 (probability 0.3). Testing method M1 provides no guarantee production deployments always select M1. Multi-agent sys- tems multiply: (0.7 × 0.8 × 0.6) = 0.336 probability for specific multi-agent path. RND 252 - Temperature and Sampling Parameter Di- vergence Across Agents. HTN planners using different tem- perature settings produce divergent decompositions. Agent A temperature 0.7 produces conservative decompositions; Agent B temperature 1.2 produces creative ones. RND 253 - Continual Method Library Evolution Break- ing Decomposition Guarantees. HTN method libraries evolve as methods add, modify, or deprecate. Multi-agent systems with asynchronous updates create version mismatch gaps where Agent A planning with library v1.0 generates decompo- sitions assuming old method availability; Agent B executing with v1.1 cannot find assumed methods. RND 254 - Lack of Decomposition Reproducibility Across Agents. HTN hierarchical planning involves many non- deterministic choices, making reproducibility difficult. Multi- agent systems lack reproducibility guarantees where different agents independently produce different decompositions. RND255 - Partial Order Scheduling Non-Determinism in Distributed Execution. HTN partial ordering permits multi- ple valid execution sequences. In multi-agent systems, Agent A specifies ordering but Agent C must resolve it. Without deterministic resolution rules, different executions produce different sequences. RND 256 - Constraint Satisfaction Heuristics Producing Divergent Solutions. HTN constraint satisfaction has multiple valid solutions. Heuristics choosing among solutions are non- deterministic. Multi-agent systems where solving and execu- tion separate enable unexpected constraint solutions. 26) RND 26 - Monte Carlo Tree Search (MCTS) Planning Non-Determinism: RND 261 - MCTS Non-Determinism in Multi-Agent Convergence. MCTS with fixed seeds produces deterministic trees; with random seeds, identical problems produce different trees. In multi-agent systems, Agent A might plan ”task X then Y” while Agent B creates ”task Y then X”. RND 262 - Dynamic MCTS Adaptation Enabling Non- Deterministic Attacks. Adaptive MCTS systems tune ex- ploration constant C dynamically. Multi-agent systems with different agents adapting C differently create heterogeneous exploration strategies. RND 263 - Simulation Budget Variance as Assurance Gap. MCTS quality depends on simulation budget. Real de- ployments have variable budgets—some cycles get 1000 sim- ulations, others get 10,000. Multi-agent resource competition forces insufficient budgets. RND 264 - Replanning Non-Determinism in Multi- Agent Workflows. MCTS replanning generates new plans when execution fails. Replanning from identical failure states with different random seeds produces different recovery plans. Attackers exploit this by forcing replanning where specific paths execute dangerous operations. RND 265 - Asynchronous Replanning State Divergence. In multi-agent systems, agents replan asynchronously. Attack- ers exploit asynchrony causing state desynchronization. RND266 - Heuristic Evaluation Inconsistency Across Agents. Each agent’s A* search uses local heuristic estimates; divergence causes agents exploring different search spaces. Multi-agent replanning introduces non-determinism through distributed computation. 27) RND 27 - Episode-Based Memory and Consolidation: RND271 - Non-Deterministic Episode Retrieval Ranking Enabling Adaptive Attacks. Retrieval combines similarity, recency, and importance with weighted scoring. Attackers craft malicious episodes with intermediate scores retrieving unpredictably. Multi-agent systems create cascade failures. RND 272 - Consolidation Timing Non-Determinism En- abling Attack Escalation Windows. Consolidation happens periodically; timing depends on load. Attackers craft episodes designed to consolidate during specific windows when other agents are absent. RND 273 - Retrieval Threshold Sensitivity as Assur- ance Gap. Similarity thresholds vary depending on context. Poisoned episodes designed to retrieve only under specific contexts avoid detection. RND 274 - Trajectory Length Variability Creating Hid- den Attack Activation Paths. Trajectories vary in length de- pending on problem complexity. Attackers craft episodes with malicious steps activating only during long trajectories when monitoring is exhausted. RND 275 - Embedding Model Update Non-Determinism Enabling Transient Poisoning Windows. Vector embeddings depend on embedding model versions. Updates change embed- ding space creating non-deterministic retrieval through tran- sient poisoning windows, differential version attacks during staged rollouts, and synchronized fleet-wide impacts when updates affect all agents simultaneously. Multi-agent systems face both asynchronous rollout windows and synchronized update impacts without stable retrieval assumptions. RND276 - Graph Traversal Path Non-Determinism in Distributed Graph Stores. Graph database queries may return multiple valid traversal paths. Poisoned relationships designed to activate specific paths avoid detection. 28) RND 28 - Knowledge Graphs and Memory Stores: RND281 - RAG Result Ranking Non-Determinism Due to Score Rounding. Document similarity scores undergo round- ing producing non-deterministic ranking boundaries. Shared ranking function creates correlated non-determinism across all agents. RND 282 - Knowledge Graph Traversal Ordering Non- Determinism. Knowledge graph traversal algorithms may visit relationships in non-deterministic orders producing different reasoning paths. RND 283 - Temporal Validity Window Boundaries Cre- ating Intermittent Visibility. Documents with validity windows visible intermittently when queries occur near boundaries. Temporal flickering creates assurance gaps where behavior depends on query timing. RND 284-ProbabilisticFactEvaluationNon- Determinism.Knowledgegraphsstoringprobabilistic facts create non-deterministic evaluation where agents sample different probabilities. Shared probabilistic knowledge enables attackers leveraging variance. RND 285 - Incremental Update Non-Determinism. Knowledge base updates apply incrementally. Agents querying during updates retrieve partially-updated data creating diver- gent snapshots. RND286-CachingInvalidationTimingNon- Determinism. Cache invalidation timing creates windows where some agents retrieve cached old data while others retrieve new data. Eventually consistent caching creates temporary semantic divergence. 29) RND 29 - Context Assembly and Working Mem- ory: RND291 - Multi-Agent Context Assembly Non- Determinism Creating Audit Blind Spots. Context assembly concatenates system prompt, history, retrieval results, and query. In multi-agent systems, assembly order varies across executions due to non-deterministic retrieval ranking and async retrieval, causing security-critical context positioning to change between audits and making reproducible auditing impossible. RND 292 - Streaming Generation Non-Determinism Across Agent Handoffs. Streaming generation exhibits vari- able token emission rates and sampling affecting precise token sequences arriving at downstream agents. Agent A streaming to Agent B produces different token sequences across executions. Malicious instructions hidden in alternative token sequences become untestable—capturing all possible orderings requires unbounded testing. RND 293 - Continual Update Propagation Creating Distributed Regression Gaps. Multi-agent systems face dis- tributed regression where updates affect different agents asyn- chronously. Agent A v2.1 while Agent B remains v2.0 creates emergent behaviors untested. Attackers systematically probe version boundaries discovering unsafe behaviors during het- erogeneous states. 30) RND 30 - Utility and Decision Making: RND301 - Probabilistic Sampling Variability in Expected Utility Cal- culation. Monte Carlo sampling methods estimating expected utility introduce non-determinism where identical decisions produce different values across executions. Multi-agent sys- tems where Agent A’s sampled utility differs from Agent B’s enable divergent decisions. RND 302 - Stochastic Outcome Distribution Changes Breaking Cached Utility Calculations. Agents caching ex- pected utility face gaps when outcome distributions change. Cached utilities become invalid but agents continue using stale values. Multi-agent cascading enables one agent’s degradation propagating through dependent agents. RND 303 - Non-Deterministic Weight Adjustment Mechanisms Creating Unsafe Adaptation. Systems dynami- cally adjusting utility weights based on outcomes face unsafe convergence. Multi-agent systems enable divergent conver- gence where agents develop incompatible utility functions. RND 304 - Evaluation Non-Reproducibility for Utility- Based Decisions. Agents making decisions through expected utility optimization face non-reproducible testing. Testing re- veals ”safe” decisions under one distribution but identical future inputs trigger unsafe decisions. 31) RND 31 - Rule-Based and Adaptive Systems: RND311 - Rule Priority Instability Creating Non- Deterministic Execution. Rule priorities determine execution order. In multi-agent systems with tunable or adaptive prior- ities, non-determinism emerges. Two identical requests may trigger different rule sequences. RND 312 - Learning Rule Instability in Adaptive Sys- tems. Rule learning systems continuously refine rules. In multi-agent shared learning, rules change creating non- deterministic behavior. RND 313 - Heuristic Parameter Drift in Multi-Agent Tuning. Heuristic parameters are tuned independently for dif- ferent agents. Parameter divergence creates non-determinism. 32) RND32 - Learning-Based Policies and Reinforcement Learning: RND321 - Learned Policy Non-Determinism Creating Assurance Gaps. Learning-based policies contain stochastic components (softmax action selection, dropout, tem- perature sampling). Identical states produce different actions. Multi-agent policy non-determinism compounds creating ex- ponential behavior variance. RND 322 - Online Learning Continual Change Defeating Validation. Systems using online learning improve during de- ployment. Assurance becomes invalid as policies drift. Multi- agent online learning propagates changes faster. RND 323 - Exploration Behavior Unpredictability as Risk Surface. Learning systems maintain exploration phases even in deployment. Inherent unpredictability creates gaps about ”will never execute dangerous exploration.” Coordinated multi-agent exploration creates correlated unpredictability. RND324-ExperienceReplayTemporalNon- Determinism. DRL samples experiences from replay buffers with temporal gaps. Same state processed with different historical context produces different updates. Shared replay buffers create shared temporal non-determinism. RND325 - Multi-Agent Coordination Emergent Behav- ior Unpredictability. MARL systems exhibit emergent be- haviors arising from agent interactions. Complete assurance requires executing all combinations, which is computationally infeasible. RND 326 - Policy Network Weight Sensitivity to Train- ing Details. Learned policies’ weights depend sensitively on training details. Identical architectures trained differently pro- duce different behaviors. Distributed training with different orders produces heterogeneous policies. RND 327 - Gradient-Based Adversarial Policy Pertur- bations. Learned policies vulnerable to adversarial perturba- tions cause misbehavior. Synchronized gradient vulnerabilities across agents enable single perturbations affecting multiple agents. 33) RND 33 - Hybrid and Heterogeneous Systems: RND 331 - Temperature Heterogeneity in Hybrid Paradigm Processing. Different paradigms require different temperature settings (deterministic rules T=0.0, optimization T=0.4, learn- ing T=0.8). Attackers exploit temperature differences crafting payloads reliably injecting to high-temperature agents while failing against deterministic agents. RND 332 - Paradigm-Specific Non-Determinism in Co- operative Cycles. Cooperative architectures iterate with non- deterministic cycle counts depending on convergence heuris- tics. Attackers craft injections activating only after spe- cific cycles. Multi-agent cooperation creates distributed non- determinism where agents cycle asynchronously. RND 333 - Streaming Response Non-Determinism in Hybrid Output Synthesis. Hybrid architectures synthesize out- puts from multiple paradigms with non-deterministic stream- ing order. Attackers craft instructions triggering only in spe- cific orders. RND334 - Knowledge Graph Consistency Assurance Gaps During Multi-Agent Evolution. Knowledge graphs evolve through agent updates with no global consistency guarantee. Attackers exploit inconsistency windows injecting contradictory relationships. RND 335 - Feedback Loop Timing Non-Determinism in Hybrid Cooperation. Feedback loops depend on relative tim- ing between components. Non-deterministic feedback timing causes different convergence paths. Attackers exploit timing forcing dangerous convergence paths. 34) RND 34 - Other Risks/Threats/Vulnerabilities worth noting: RND341 - Keyboard Navigation Testing Gaps for Approval Workflows. Keyboard navigation testing is fragile due to dynamic DOM manipulation, asynchronous render- ing, and focus management edge cases. Tests pass with synchronous rendering but fail with latency-delayed render- ing. Progressive disclosure controls changing tab order break assumptions. Multi-agent workflows amplify fragility with unpredictable approval request ordering. Mitigation requires focus stability assertions, latency simulation, ARIA testing, tab order snapshots, and manual screen reader testing. RND 342 - HITL Approval Testing Non-Reproducibility. HITL approval workflows exhibit non-deterministic behavior from confidence score variance, dynamic threshold adjust- ments, and time-based expiration. Adaptive thresholds learn- ing from user patterns create non-determinism. Multi-agent contexts amplify this through threshold learning interactions. Mitigation requires deterministic test modes, confidence seed- ing, approval path assertions, threshold configuration version control, and telemetry logging. RND 343 - Auto-Scaling Non-Determinism in Replica Configuration. Auto-scaling may not guarantee identical replica configuration (different model versions, parameters, resources). Testing on current replicas doesn’t guarantee future scaled replica behavior. RND 344 - Batching Timeout Non-Determinism. Dy- namic batching with probabilistic timeouts creates non- deterministic batch compositions. The same requests might batch differently across executions. RND 345-LoadBalancingAlgorithmNon- Determinism. Some load balancing algorithms introduce non-determinism in routing. The same request might route to different replicas across executions. RND 346 - Caching Invalidation Non-Determinism. Cache invalidation based on TTL or events creates non- deterministic cache states. Whether queries hit cache depends on uncontrolled temporal factors. RND347 - Non-Deterministic Evaluation Due to Model Temperature Settings. Evaluating agents with variable tem- perature settings produces non-deterministic results making comparisons unreliable. Attackers exploit temperature varia- tion hiding metric variance. RND 348 - Evaluation Instability From Framework Ver- sion Changes. Framework version changes affect evaluation infrastructure. Example: MLflow metric aggregation changing NaN handling between versions. RND 349 - Continuous Evaluation CI/CD Timing Vari- ations. CI infrastructure has variable performance. Non- deterministic timing could affect evaluation with timeout- based decisions. RND3410 - Evaluation Workflow State Machine Non- Determinism. Evaluation workflows process test cases through stages. Non-deterministic transitions affect results if agents have state-dependent behavior. RND 3411 - Model Update Timing Creating Evaluation Windows. Continuous agent updates create non-deterministic evaluation based on update timing. Attackers time malicious updates to evaluation blind spots. RND 3412 - Difficulty Classification Continual Adap- tation Creating Assurance Evasion. Difficulty classification changes sampling budget based on problem characteristics. Same inputs receive variable budgets over time. Multi-agent shared classifications face uniform drift. RND3413 - Non-Deterministic Path Ordering in Weighted Voting. When multiple paths achieve identical quality scores, ordering becomes non-deterministic. Multi- agent voting propagation creates downstream non-determinism where tie-breaking affects all downstream agents. RND 3414 - Semantic Chunking Boundary Non- Determinism Across Paragraph Detection Heuristics. ETL se- mantic chunking splits documents at natural boundaries using implementations like + or 2, detecting paragraphs differently. Edge cases with mixed line endings produce non- deterministic chunking where identical documents chunk dif- ferently. Windows-style versus Unix produce different matches. Agent A chunks using detection (Unix only) while Agent B uses universal newline detection (both styles), creating different boundaries. Boundary search using approximate token counting (1 token ≈ 4 characters) versus exact tiktoken-based counting produces variations. Multi-agent systems with heterogeneous ETL versions experience system- atic inconsistencies: Agent A chunks a manual into 47 chunks while Agent B chunks identical content into 51 chunks. Shared vector databases contain duplicative near-identical chunks with different boundaries. No ”correct” chunking exists—both valid variants prevent detection. RND 3415 - Deduplication Hash Collision Non- Determinism in Concurrent Multi-Agent Extraction. ETL deduplicationusingcontenthashing(SHA-256)with seen_hashes = set() tracking creates race conditions in concurrent extraction. When Agent A and Agent B simultaneously extract shared documents and both read document D at timestamp T, they independently compute hash(D) and check separate seen hashes sets. Both checks return False, causing duplicate processing. Multi-agent extraction scheduled simultaneously (hourly at :00) systematically experiences this: all agents begin extraction, read overlapping documents, and independently decide to process duplicates. With 20 agents extracting from shared sources, 20 independent deduplication decisions cause 15-40% duplicate rates depending on random timing. Persistent Redis-based deduplication introduces network- timing non-determinism in SET operation ordering. Fuzzy MinHash deduplication compounds with timing-dependent signature storage. RND 3416 - REST API Pagination Cursor Non- Determinism Creating Inconsistent Multi-Agent Extraction. ETL extraction from REST APIs using pagination faces non- determinism when new data inserts during extraction. Agent A fetching page 1 at 14:00 receives page token for page 2. Before fetching page 2, a new record is inserted shifting pagination—ticket #1050 now appears on page 2 instead of page 1, causing Agent A to retrieve it. Agent B extracting at 14:05 retrieves different page 1 including the inserted record, causing #1050 to appear in both extractions. Incremen- tal updated_since=2024-11-10 filtering misses records inserted during multi-page spans. Multi-agent staggered sched- ules (Agent A :00, B :05, C :10) create different pagination states producing different record sets. Cursor non-determinism prevents re-extraction validation: re-running produces different results due to source changes. RND 3417-FilesystemModificationTime Resolution Variability Affecting Incremental ETL Updates. IncrementalETLusing file.stat().st_mtime > last_run_timestampfacesplatformvariability. Linux ext4: nanosecond resolution; Windows NTFS: 100- nanosecond; FAT32: 2-second. Agent A on Linux detects microsecond changes; Agent B on Windows misses 2-second- window updates. Network filesystems (NFS, SMB) add clock skew: Agent A’s 14:00:00.000 clock checks against server 14:00:00.500, but 200ms latency means client time 14:00:00.200 against server 14:00:00.500 creates ambiguity. Multi-agentheterogeneousinfrastructuresystematically detects different change sets. High-frequency updates (auto- save every 30s) produce 10 versions for Linux but 1 for Windows with 2-second resolution. Mtime non-determinism prevents reproducible updates. RND 3418-BatchSubdivisionOrderingNon- Determinism During Partial ETL Failure Recovery. ETL batch insertion (1,000 records/batch) with failure handling faces non-determinism in subdivision strategies. When batch fails at record 734, binary subdivision splits [0:500] and [500:1000] differently than failure-point subdivision [0:734] and [735:1000]. Agent A retries binary (5 attempts: [0:500], [500:750], [750:875], [875:937], [937:968]) while Agent B retries failure-point (2 attempts: [0:734], [735:1000]), creating different database load patterns. Multi-agent simultaneous failures with different strategies risk deadlocks: Agent A acquires locks [0:500] then [500:750], Agent B acquires [0:734] then [735:1000], overlapping ranges cause deadlocks. Parallel versus sequential retry ordering further compounds: parallel retries commit out-of-order relative to original positions. RND 3419 - Quality Metric Calculation Variability Across Heterogeneous Agent Validation Implementations. Quality validation uses five-dimensional assessment (com- pleteness, accuracy, consistency, timeliness, validity) with het- erogeneous methods. Completeness diverges: Agent A binary field counting, Agent B token-weighted, Agent C entropy. Ac- curacy differs: exact matching, range validation, or statistical outliers. Consistency uses pair constraints, temporal ordering, or referential integrity. Multi-agent shared thresholds fail— completeness ≥ 0.80 passes some agents but fails oth- ers. Attackers route documents to lenient implementations; shared bases accept rejected documents. Multi-agent hetero- geneous methods enable bypass. F. Telemetry and monitoring blind spots specific to cognitive and tool behavior Existing observability stacks are poorly aligned with cog- nitive and workflow-level threats in agentic systems. Standard infrastructure monitoring focuses on deterministic components and metrics, logs, and traces; it rarely inspects prompt con- tent, retrieved documents, memory mutations, or inter-agent messages. Key blind spots include limited visibility into internal reasoning, tool selection rationales, and intermediate thoughts retained only as unstructured text, making detection of prompt infections, policy drift, or specification gaming difficult. 1) RTM1 - UI and Interface Telemetry Gaps: RTM11 - Progressive Disclosure Hiding Malicious Activity in Collapsed Views. Progressive disclosure patterns hide technical details and reasoning traces in collapsed views, creating observability blind spots where suspicious tool invocations appear only in expanded technical layers that users rarely inspect. In multi- agent systems, each agent’s disclosure layers operate indepen- dently, enabling attackers to exploit monitoring focused on user-visible essential views while malicious operations execute in hidden technical views. The risk is amplified because monitoring must track disclosure state across multiple agents simultaneously, creating blind spots unavailable in single-agent systems. RTM 12 - Chat Interface Logging Missing Semantic Context and Intent. Chat interfaces log conversation histories as message sequences but fail to capture semantic meaning, reasoning provenance, and intent classification necessary for security monitoring. In multi-agent environments, security analysis requires understanding cross-agent reasoning flows, yet standard logs record what was said but not why agents chose specific tools, which data sources were accessed, or whether query patterns match attack signatures. Without se- mantic logging capturing decision graphs, security teams can- not distinguish legitimate complex workflows from coordi- nated attacks. RTM 13 - Streaming Response Telemetry Gaps Creating Attack Detection Delays. Streaming response patterns create telemetry collection challenges where security monitoring cannot analyze complete responses until streaming finishes, introducing detection delays. In multi-agent systems where agents stream outputs to one another, streaming handoffs create multiple points where partial telemetry must be aggre- gated, and malicious instructions embedded in long streaming responses may evade detection. Non-deterministic streaming timing makes baseline establishment difficult, creating blind spots where attacks manipulating streaming timing evade detection entirely. RTM 14 - Approval Workflow Telemetry Recording De- cisions Without Reasoning Provenance. Approval workflow interfaces log human decisions but fail to capture complete reasoning provenance, including which agent assessments in- fluenced decisions and how disclosure states affected review. In multi-agent systems, poisoning one specialized agent’s input to inflate overall confidence scores allows attacks where audit logs show approval without capturing the fraudulent confidence aggregation. This gap means security teams cannot determine whether approvals reflected comprehensive review or resulted from compromised agent outputs. RTM 15 - Command Palette Suggestion Telemetry Miss- ing Context Manipulation Indicators. Command palette pat- terns generate telemetry showing suggested and executed com- mands but fail to capture why suggestions appeared or whether context was manipulated to bias suggestions toward malicious operations. In multi-agent systems where suggestions aggre- gate context from multiple source agents, monitoring requires understanding context provenance graphs to detect attacks where poisoned context causes malicious commands to appear as legitimate suggestions. Standard telemetry only logs final suggestions and user actions, missing the middle layer showing how context signals combined to produce suggestions. RTM 16 - Error Recovery Telemetry Treating Retry Attempts as Atomic Events. Error communication patterns implementing automatic retry treat each retry as an inde- pendent atomic event rather than capturing complete retry sequence context, allowing attackers to craft inputs that trigger errors in early agents while executing malicious payloads in retry agents. In multi-agent systems, error recovery involves specialized agents with different security contexts across retry attempts, requiring correlation of telemetry across all agents. Standard telemetry showing only final retry outcomes misses that each attempt may have processed subtly different inputs or exercised different code paths. RTM 17 - Context Awareness Telemetry Missing Cross- Session State Poisoning Indicators. Context awareness features that persist conversation history create long-lived cognitive state, but telemetry typically treats each session independently rather than tracking context evolution across boundaries. In multi-agent systems sharing context across specialized agents and persisting across sessions, attackers can inject malicious instructions in early sessions that propagate through agents across subsequent sessions, while standard telemetry captures no persistent state threads. Detecting cross-session, cross-agent state manipulation unfolding over days or weeks requires capabilities that traditional monitoring lacks. RTM 18 - Multi-Agent Dashboard Attribution Telemetry Gaps Enabling Impersonation. Multi-agent dashboards cre- ate attribution challenges requiring tracking not just content but which agent generated it and whether attribution signals could be manipulated. Standard telemetry logs displayed con- tent without capturing whether agent identity was verified or whether content bypassed output verification, making it impossible to distinguish legitimate recommendations from impersonation. This provenance gap is specific to multi-agent systems where complex attribution graphs replace the simple single-agent attribution that standard infrastructure supports. RTM 19 - Inline Suggestion Telemetry Missing Rejection Pattern Analysis. Inline suggestion patterns generate telemetry showing accepted suggestions but fail to capture rejection patterns necessary to detect compromised agents generating in- creasingly suspicious suggestions that users consistently reject. In multi-agent systems with specialized suggestion agents, detecting poisoning requires cross-agent rejection analysis comparing rejection rates across agents, contexts, and users. Without telemetry capturing rejection reasons, monitoring cannot distinguish normal acceptance variation from security- relevant degradation. RTM 110 - Tool Invocation Logging Without Parameter Semantic Analysis. Agent UI patterns log tool invocations with parameters but treat parameters as opaque values rather than analyzing semantic appropriateness given conversation context. In multi-agent systems, tool parameters may originate from poisoned upstream agents, yet logs showing a tool call cannot detect parameter injection attacks without capturing pa- rameter provenance. Multi-agent tool invocation logging must trace parameter provenance across agents to detect attacks where legitimate tool invocations become malicious through poisoned cross-agent context. RTM 111 - Confidence Score Telemetry Missing Decom- position and Aggregation Transparency. Interfaces displaying confidence scores help users calibrate trust but telemetry fails to capture calculation methods and multi-agent aggregation, making it impossible to detect when a compromised agent manipulates its contribution to skew displayed confidence. In multi-agent systems, overall confidence represents a weighted aggregation across specialized agents, and monitoring must capture each agent’s contribution, weighting, and whether individual agents reported anomalously. This decomposition is critical for detecting sophisticated attacks that compromise specific high-weight agents to drive human oversight deci- sions. RTM 112 - Session Persistence Telemetry Missing State Restoration Verification. Context awareness enabling conver- sation resumption relies on session persistence, but telemetry captures loading without verifying integrity or detecting unau- thorized modifications between sessions. In multi-agent sys- tems where restored state includes context shared across agents from distributed storage, monitoring must check not only individual state but cross-agent consistency. Without telemetry capturing restoration verification such as hash checks and access logs, monitoring lacks visibility into whether resumed sessions reflect authentic interactions or compromised storage. RTM 113 - Real-Time Reasoning Trace Telemetry Per- formance Overhead Creating Sampling Bias. Comprehensive reasoning trace logging creates performance overhead that forces sampling strategies, creating blind spots where non- sampled attacks evade detection. In multi-agent systems, at- tacks may target non-sampled agents or exploit timing win- dows, such as routing malicious operations through agents whose traces are only sampled for high-risk classifications. Performance-observability tradeoffs are more severe in multi- agent systems because comprehensive cross-agent telemetry requires real-time correlation, and computational cost forces sampling that risks missing the specific cross-agent reasoning connections revealing coordinated attacks. RTM 114 - User Intervention Telemetry Missing Pre- Intervention State Context. User control mechanisms gen- erate telemetry showing that interventions occurred but fail to capture complete pre-intervention state, including the dis- tributed agent state at the time of intervention. In multi-agent systems, pausing a workflow stops multiple in-flight agents simultaneously, yet monitoring lacks the context to determine whether intervention prevented an attack or cancelled a legiti- mate operation. Without pre-intervention telemetry, monitoring cannot learn from intervention patterns to improve detection or trigger automated alerts for specific high-risk agent interaction combinations. RTM 115 - Cost and Resource Telemetry Hiding Eco- nomic Attack Indicators. Interfaces capturing resource con- sumption collect telemetry for operational purposes but stan- dard monitoring does not analyze economic patterns for secu- rity indicators despite their relevance. In multi-agent systems, unusual cost distributions may indicate compromised agents repeatedly invoking expensive operations, and multi-agent attribution requires correlating costs across agents and time to detect cascading economic attacks. Traditional monitor- ing treats resource usage as operational rather than security telemetry, missing attack signals such as unusual token usage indicating prompt injection or abnormal API patterns indicat- ing tool misuse. RTM 116 - HITL Monitoring Telemetry Blind Spots. HITL workflow monitoring suffers gaps where standard aggre- gate metrics hide critical individual decision points, and teams optimize for high auto-approval rates without monitoring UIs surfacing early warnings. Multi-agent systems amplify this because intervention in one agent workflow may prevent cascading failures in dependent agents, but telemetry does not capture cross-agent intervention effects. Mitigation requires detailed intervention event logging capturing trigger metrics, reaction times, near-miss tracking, and dashboard interaction analytics identifying which monitoring elements users engage with versus ignore. RTM 117 - Accessibility Telemetry Gaps in Screen Reader Usage. Monitoring dashboards optimized for visual scanning fail screen reader users, but standard analytics as- sume visual interaction patterns and leave screen reader nav- igation unmeasured, creating invisible barriers. Multi-agent monitoring dashboards compound this because screen reader users may successfully monitor some agents while unable to access critical details for others, yet without accessibil- ity telemetry these barriers cannot be identified. Mitigation requires assistive technology detection, landmark navigation telemetry, ARIA live region effectiveness measurement, and accessibility heatmaps capturing keyboard and screen reader navigation patterns. 2) RTM 2 - Framework-Specific Architecture and Logging Gaps: RTM21 - Plan-and-Execute Opacity in Multi-Tier Agent Hierarchies. Multi-tier Plan-and-Execute architectures create observability dead zones where supervisor agents plan, workers execute, and sub-workers perform specialized tasks across tiers with different memory contexts and logging gran- ularity. The monitoring gap emerges from context fragmenta- tion: downstream workers receive aggregated results lacking visibility into derivation and causal attribution, making it im- possible for security teams to determine which tier introduced corruption. Adversaries exploit this opacity through multi-tier prompt injection, embedding malicious instructions in data sources that sub-workers access. RTM 22 - Tool Chain Monitoring Gaps Enabling Covert Privilege Escalation. Multi-agent systems with distributed tool access create blind spots where individual tool calls appear benign in isolation but form attack chains sequenced across agents. Each agent’s permissions appear properly constrained when examined individually, yet attackers exploit cross-agent chaining to escalate privileges by routing data through agents with complementary capabilities. Security monitoring on a per-agent basis misses cross-agent orchestration patterns en- abling privilege escalation, data exfiltration, and unauthorized actions. RTM 23 - Correlation ID Manipulation Creating Dis- tributed Tracing Blind Spots and Causal Ambiguity. Multi- agent systems use correlation IDs to link distributed operations across agent boundaries, and attackers can manipulate these IDs to fragment traces, sever causal links, or create ambiguity preventing investigation. Attacks succeed because tracing as- sumes IDs are trustworthy and lacks cryptographic verification of authenticity, transforming correlation IDs into manipulation vectors unique to multi-agent architectures. Mitigation requires cryptographic ID chains where agents sign modifications prov- ing lineage, anomaly detection for suspicious patterns, and multi-source reconstruction combining IDs with timing and provenance analysis. RTM 24 - Emergent Behavior Blind Spots in Decen- tralized Swarm Systems Creating Monitoring Gaps. Swarm intelligence systems achieve coordination through simple lo- cal rules, and individual telemetry can appear normal while system-level behavior is malicious or degraded due to biased interactions propagating through consensus. Unlike hierarchi- cal systems with centralized orchestrators providing global visibility, swarm systems have no agent with comprehensive awareness, and emergent properties exist only in collective behavior from distributed interactions. Agent-level telemetry cannot detect emergent misalignment, requiring external sys- tem simulation or behavioral invariants to validate collective outcomes. RTM 25 - Framework-Specific Monitoring Blind Spots Creating Distributed Observability Gaps. Different frameworks expose different operational metrics, and multi-agent systems combining frameworks create observability gaps at framework boundaries where no single monitoring system has complete visibility. An attack routing through one framework’s plugins may execute tool calls invisible to another framework’s state monitoring, and framework differences in what they expose create permanent blind spots undetectable through framework- level monitoring alone. Unlike single-framework systems with comprehensive internal visibility, multi-agent systems require unified observability that current monitoring tooling does not provide. RTM 26 - Framework Architecture Documentation Gaps Enabling Attack Reconnaissance. Multi-agent systems docu- mented at the individual framework level rarely explain cross- framework integration patterns or boundary behavior, creating reconnaissance opportunities for attackers who can synthe- size cross-framework attack plans from publicly available framework-specific documentation. Documentation explaining each framework’s threat model helps attackers understand that the same malicious instruction may fail validation in one framework’s output parser but pass in another framework’s input parser. Unlike singular systems documented as single architectures, multi-agent systems documented as framework collections enable attackers to derive multi-framework attack strategies by composing framework-specific knowledge. RTM 27 - Checkpoint-Mediated State Mutations Evading Audit Trails. Agents can exploit checkpointing by modifying state before checkpointing, then relying on checkpoint recov- ery to obscure modifications, because audit logs show the final restored state but not intermediate corruptions. In multi- agent workflows, an agent can checkpoint immediately after injection, making that checkpoint the baseline for subsequent resumptions, while detection requires cross-agent state con- sistency verification. Multi-agent checkpoint forensics require analyzing cross-agent state rather than a single agent’s state, creating detection challenges when changes across multiple agents’ contexts appear legitimate when individually reviewed. RTM 28 - Conditional Routing Decision Opacity in Multi-Agent Monitoring. Conditional edges determine control flow but their routing decisions are not always logged with reasoning context, so monitoring sees the routing destination but not why the route was chosen. In multi-agent systems, conditional edge decisions for one agent influence downstream agents’ state inputs, making audit trails insufficient for security analysis without understanding routing decisions. Multi-agent routing creates cascading decisions where each agent’s condi- tional routing affects others’ received state, requiring complete routing decision graphs for comprehensive audit trails. RTM 29 - Reducer State Evolution Tracking Gaps. State reducer execution is not always traced in logging, making it difficult to understand how field values transformed across iterations or whether field growth results from legitimate accumulation or malicious injection. Multi-agent systems lack unified visibility into all reducer operations across specialized agents, creating observability gaps where one agent’s reducer behavior remains invisible to monitoring. Comprehensive re- ducer execution tracing across agent boundaries is required but rarely implemented. RTM 210 - ConversationBufferMemory Telemetry Gap for Injection Detection. LangChain’s conversation memory is typically logged as message sequences without semantic analysis that would identify whether responses indicate prompt injection through suspicious tool selections or contradictory statements. Multi-agent message logging must capture cross- agent communication patterns to identify where poisoned data propagates, whereas singular systems need only analyze single agent outputs. RTM 211 - Agent Scratchpad Reasoning Trace Logging Gaps. While agentscratchpad represents complete reasoning, it is rarely included in telemetry beyond step counts, leav- ing reasoning traces containing injection indicators or policy drift unmonitored. Multi-agent reasoning traces must correlate across agents showing how one agent’s reasoning influenced downstream agents, whereas singular tracing focuses on indi- vidual reasoning. RTM 212 - Tool Invocation Semantic Analysis Gaps. LangChain telemetry logs tool invocations with parameters but lacks semantic analysis of parameter appropriateness, making contextually inappropriate or poisoning-driven invoca- tions indistinguishable from legitimate ones. Multi-agent tool invocation monitoring must trace parameter provenance across agents to detect injection through parameter chains. RTM 213 - Memory Update Provenance Gaps for State Poisoning Detection. Telemetry captures memory state snap- shots but not which agent modified state or whether modifica- tions reflect legitimate learning or poisoning, so state changes appear as normal evolution without distinguishing poisoning from updates. Multi-agent memory telemetry must track which agent modified shared state and whether modifications propa- gated unexpectedly to other agents. RTM 214 - Error Recovery Sequence Telemetry Gaps. When error recovery triggers, telemetry logs retry counts but not which code paths retries exercise, allowing attackers who deliberately trigger errors to force specific retry paths while leaving minimal telemetry evidence. Multi-agent error orchestration telemetry must correlate errors across agents to detect coordinated error injection attacks. RTM 215 - Confidence Score Calculation Decomposition Gaps. Telemetry lacks decomposition showing which aspects contributed to final confidence scores, causing score changes to appear random rather than indicating manipulation. Multi- agent confidence aggregation telemetry must show per-agent scores and weighting to enable detection of single-agent compromise affecting overall scores. RTM 216 - AutoGen GroupChat Message History Log- ging Creating Attribution Blind Spots. AutoGen’s shared message history logs all inter-agent communication without semantic analysis of message intent, reasoning dependencies, or attack patterns, leaving security teams unable to attribute attacks within multi-agent dialogue. Singular agent logs show one agent’s reasoning, while AutoGen logs show peer-to-peer communication making attack attribution impossible without semantic analysis of dialogue patterns. RTM 217 - CrewAI Task Execution Trace Opacity in Hierarchical Delegation. CrewAI hierarchical task traces log which agents received tasks but fail to capture task context ma- nipulation, whether delegations were appropriate, or whether workers acted as intended. Singular task execution logs show execution sequence, whereas CrewAI logs lack decision con- text for understanding whether hierarchical delegation was appropriate or compromised. RTM218 - Multi-Agent Monitoring Dashboard Visual- ization Blind Spots. Multi-agent dashboards aggregating agent status from multiple sources create visualization challenges where simultaneous activity patterns become uninterpretable, leaving coordinated attack signatures invisible in aggregate dashboards. Singular agent dashboards show one operation sequence, whereas multi-agent dashboards must distinguish legitimate parallelism from coordinated attacks. RTM 219 - AutoGen Conversation Pattern Non- Determinism Preventing Baseline Establishment. AutoGen’s non-deterministic conversation flows prevent establishing re- liable baseline patterns for anomaly detection, making it im- possible to reliably differentiate normal variation from attack- driven variation. Singular agent baselines can be established for deterministic operations, but AutoGen’s conversation non- determinism defeats baseline-based monitoring. RTM 220 - CrewAI Hierarchical Monitoring Opacity Preventing Tier Responsibility Attribution. Multi-tier hierar- chies in CrewAI create monitoring challenges where attacks at one tier affect outcomes at other tiers, making responsibility attribution impossible when output contains errors. Singular agent forensics can trace issues to one source, while CrewAI’s multi-tier architecture creates opacity preventing determination of which management level was compromised. RTM 221 - Plugin Execution Trace Abstraction Hiding Plugin Chain Visibility. Semantic Kernel’s orchestration ab- stracts multi-plugin execution chains into high-level operation summaries, hiding which plugins executed, in what order, and with what parameters. Multi-agent orchestration across multiple agents prevents end-to-end tracing of plugin chains, whereas singular orchestration maintains full visibility. RTM 222 - Function Description Processing Telemetry Missing Injection Detection. Semantic Kernel processes plugin function descriptions to construct orchestrator prompts without telemetry analyzing description content for injected instruc- tions, allowing malicious descriptions to poison orchestrator context invisibly. In multi-agent systems with a shared plugin registry, description-level poisoning affects all agents simulta- neously and leaves no per-agent telemetry evidence. RTM 223 - Dependency Injection Resolution Telemetry Gaps. Kernel service resolution is not always instrumented to reveal which plugins resolved which services, and when ma- licious service implementations are injected, telemetry lacks visibility into the substitution. Kernel-level service injection affects all agents invisibly, whereas per-agent dependency resolution creates per-agent detection opportunities. RTM 224 - Orchestrator Prompt Construction Telemetry Missing Context Pollution Detection. Orchestrator prompts aggregate function descriptions from all available plugins but telemetry does not capture prompt content or detect injected instructions, so compromised prompts leave only successful orchestration records. Shared orchestrator prompt construction means context pollution affects all agents’ routing decisions, whereas singular orchestration provides a single detection point. RTM 225 - Plugin Routing Decision Opacity in Observ- ability. LLM-driven routing telemetry typically shows only the selected plugin without capturing reasoning, which descrip- tion caused selection, or why a specific plugin won routing competition, preventing detection of poisoned descriptions that bias routing. Multi-agent orchestration with distributed routing decisions requires correlation across agents to detect biased routing patterns, whereas singular routing is transparent. RTM 226 - Framework-Specific Semantic Kernel Moni- toring Blind Spots. Semantic Kernel exposes unique telemetry points that generic framework monitoring does not capture, and organizations standardized on other frameworks may lack Semantic Kernel-specific observability. Multi-agent systems mixing Semantic Kernel with other frameworks create blind spots at framework boundaries, whereas single-framework systems maintain consistent telemetry across the stack. 3) RTM3 - Tool Invocation and Function Calling Mon- itoring: RTM 31 - Tool Invocation Telemetry Correlation Attacks. In multi-agent systems, attackers can create specific tool invocation sequences across agents that appear legitimate individually but encode hidden communication channels or coordination commands. Telemetry showing normal-appearing tool sequences cannot detect patterns spanning multiple agents that fall below single-agent detection thresholds. Single-agent tool pattern analysis is holistic for one agent, whereas multi- agent patterns enable attackers to construct sequences across agents that evade per-agent monitors. RTM 32 - Function Calling Anomaly Detection Evasion Through Distributed Invocation. Anomaly detection monitors individual agents for unusual function calling patterns, but multi-agent systems enable attackers to distribute anomalous invocations so each agent individually appears normal while collectively executing an attack. A single agent with all anomalous invocations would be obvious, whereas distributed anomalies across agents evade per-agent anomaly detection entirely. RTM 33 - Tool Latency Monitoring Blind Spots in Paral- lel Execution. Tool performance monitoring tracks invocation latency, but multi-agent systems invoking tools in parallel may mask slow individual tool invocations behind aggregated metrics. Attackers exploit the resulting per-tool latency blind spots because sequential single-agent tool invocation exposes clear per-tool latency, whereas multi-agent parallel execution obscures it. RTM 34 - Tool Output Validation Monitoring Gaps Across Agent Boundaries. Tool output validation occurs at the agent level, and in multi-agent systems, outputs validated by one agent may not be re-validated by downstream agents consuming them. Attackers exploit validation gaps across agent boundaries where output passes one agent’s validation but is corrupted for the consuming agent’s context, whereas single-agent systems validate outputs once with no handoff gap. RTM 35 - Tool Authorization Scope Audit Blind Spots. Audit logs may show an agent authorized to invoke a tool without capturing that the agent delegated invocation to an- other unauthorized agent using the first agent’s authorization context. Single-agent authorization is unambiguous, whereas multi-agent delegation creates authorization accountability gaps in audit trails. RTM 36 - Tool Invocation Causality Tracking Failures in Asynchronous Execution. Asynchronous tool invocation in multi-agent systems creates causality ambiguity where the attributing monitoring system may associate an invocation with the wrong initiating agent. Single-agent synchronous invo- cation has clear causality, whereas multi-agent asynchronous execution enables attackers to spoof causality in logs. 4) RTM 4 - Multimodal and Streaming Response Pro- cessing: RTM41 - Multimodal Processing Opacity Creating Monitoring Blind Spots. Vision model processing produces outputs rarely included in logs or monitoring dashboards, creating blind spots where malicious vision model behavior goes undetected in multi-agent systems. Agents whose tool invocations are driven by unmonitored vision model outputs appear to make autonomous decisions, and the true influence of vision model outputs on tool selection is invisible to moni- toring. Single-agent tool invocations are monitorable, whereas multi-agent systems where vision models drive tool selections in hidden layers create attribution gaps. RTM 42 - Multimodal Attribution Opacity in Tool Invo- cation Tracing. When agents invoke tools based on multimodal RAG results, monitoring cannot determine whether tools ex- ecuted due to text queries, image evidence, or combinations, enabling attacks that embed injected instructions in retrieved images while appearing as legitimate text-driven reasoning. Multi-agent systems further obscure attribution across bound- aries where one agent’s vision processing drives another agent’s tool selection invisibly. RTM 43 - Vision Model Hallucination Detection Ab- sence in Monitoring. Vision models hallucinate content not present in inputs, yet monitoring systems do not detect hallu- cinations because outputs match expected format. In multi- agent systems, hallucinated content from one agent drives tool invocations and decisions in dependent agents without any monitoring detecting the fabricated source data, creating cascading undetected hallucination propagation. RTM 44 - Embedding Similarity Threshold Opacity in Retrieval Monitoring. Multimodal RAG systems retrieve con- tent based on embedding similarity thresholds but monitoring does not track whether retrieved content barely exceeded those thresholds, creating blind spots. Attackers craft poisoned embeddings positioned just above retrieval thresholds, consis- tently retrieving malicious content while appearing legitimate in logs. RTM 45 - Streaming Multimodal Output Processing Monitoring Gaps. Multimodal synthesis produces streaming outputs combining mixed modalities, and in multi-agent sys- tems, dependent agents may process partial output before the full response is generated, creating unmonitored intermediate states. Text streaming creates linear progression, whereas multimodal streaming with mixed modalities creates complex ordering dependencies that monitoring struggles to validate for consistency across modality streams. RTM46 - Cross-Modal Consistency Validation Absence in Monitoring. Monitoring does not validate consistency across modalities such as whether image content matches text de- scriptions or extracted data matches source charts, creat- ing blind spots where cross-modal inconsistencies indicating attacks go undetected. Single-modality monitoring validates within domain, whereas multimodal systems require cross- domain validation that is rarely implemented. RTM 47 - Error Message Content Opacity Creating De- tection Blind Spots. Error logging captures error messages but lacks semantic analysis of message content, allowing attackers to craft error messages containing malicious instructions that telemetry captures but does not parse. In multi-agent systems, error message content analysis is essential for detecting attacks embedding instructions in error context, but standard telemetry treats error messages as opaque unstructured text. RTM 48 - Retry Sequence Telemetry Missing Attack In- dicators. Retry telemetry shows retry counts and success rates but fails to capture retry sequence characteristics indicating attacks, such as rapid succession retries or simultaneous retries from multiple agents. Standard telemetry recording only final retry outcomes misses detailed sequence patterns that semantic analysis could identify as attack signatures. RTM 49 - Fallback Routing Telemetry Missing Context Triggers. Fallback routing telemetry shows which fallback routes were selected but not what error conditions triggered fallback or whether context was manipulated to force fall- back to compromised alternatives. Detecting fallback attacks requires understanding trigger conditions, which standard telemetry that omits context trigger analysis cannot provide. RTM 410 - Circuit Breaker State Transition Telemetry Gaps. Circuit breaker telemetry logs state changes but lacks detailed failure analysis explaining why the circuit opened, missing attack indicators where deliberate failures force state changes. Standard telemetry showing state transitions without capturing specific failure patterns cannot detect attacks exploit- ing circuit breaker logic. RTM411 - Graceful Degradation Decision Opacity in Telemetry. Degradation telemetry shows which capabilities degraded but not why specific degradation decisions were made, making attacks that manipulate component health sig- nals to trigger unintended degradation indistinguishable from legitimate responses to failures. Transparent degradation deci- sion telemetry capturing all influencing factors is required for security monitoring but typically absent. RTM 412 - Error Recovery Coordination Telemetry Missing Cross-Agent Causality. Error recovery in multi- agent systems involves coordinated actions across agents, but telemetry captures individual agent actions without cross-agent causality analysis, making distributed error injection attacks that exploit recovery coordination undetectable. Comprehen- sive error recovery monitoring requires capturing complete recovery orchestration that standard per-agent telemetry omits. RTM 413 - Streaming Error Handling Telemetry Missing Intermediate State Visibility. Error handling in streaming con- texts creates temporary error states that resolve before response completion, and telemetry focused on final outcomes may not capture these transient states. Attacks exploiting streaming error handling to trigger fallback that completes before mon- itoring notices leave minimal telemetry evidence, requiring intermediate state visibility that most streaming telemetry does not provide. RTM 414 - Streaming Telemetry Collection Gaps Cre- ating Real-Time Attack Opacity. Streaming responses create telemetry collection challenges where complete analysis is only possible after streaming finishes, creating a temporal lag that attackers exploit by injecting content appearing benign in partial streams but malicious when complete. Multi-agent systems with multiple simultaneous streaming agents amplify the aggregation challenge, and the detection lag creates vul- nerabilities before monitoring systems complete analysis. RTM 415 - Streaming Progress Indicator Manipulation for Activity Obfuscation. Streaming progress indicators can be manipulated by attackers controlling streaming speed to hide expensive or malicious internal processing behind a deceptively slow visible stream. Multi-agent monitoring that observes only visible streaming progress misses background processing by other agents, exploiting the decoupling of visible progress from actual system load. RTM 416 - Cross-Agent Streaming Correlation Failures in Distributed Tracing. Multi-agent systems correlating stream- ing traces using correlation IDs face failures when streaming timing variations cause events to appear out-of-order in logs, and attackers can manipulate streaming order to fragment traces and make cross-agent causality reconstruction impossi- ble. Multi-agent streaming creates N! possible event orderings compared to centralized single-stream ordering, systematically defeating trace reconstruction. RTM 417 - Streaming Buffer Overflow Telemetry Gaps. Streaming buffer overflow telemetry often logs the fact of overflow without capturing the discarded content, allowing attackers to deliberately stream large content exploiting buffer overflow to discard malicious payloads while telemetry only shows that overflow occurred. Multi-agent buffer overflows across multiple channels create distributed loss patterns that are difficult to correlate, enabling attackers to fragment pay- loads across multiple overflows. RTM 418 - Streaming Rate Limiting Evasion Through Distribution. Rate limiting on streaming endpoints can be evaded in multi-agent systems by distributing streaming across multiple agents, each below individual rate limits while the aggregate exceeds system capacity. Multi-agent streaming requires cross-agent coordination for effective rate limit en- forcement, and monitoring N concurrent streaming agents for aggregate enforcement creates operational complexity that enables distribution-based evasion. 5) RTM 5 - Evaluation and Assessment Telemetry Gaps: RTM51 - Evaluation Result Anomaly Detection Missing In- jection Indicators. Evaluation monitoring systems track metric trends but do not analyze evaluation results semantically for prompt injection or manipulation indicators, missing attacks where evaluation results change in suspicious patterns such as sudden favorable shifts after metric definition updates. Unlike infrastructure monitoring detecting resource anomalies, evaluation-specific monitoring requires semantic analysis of metric behaviors that current systems lack. RTM 52 - Evaluation Agent Decision Reasoning Teleme- try Gaps. Evaluation agents make decisions about metric weighting and deployment approval without telemetry captur- ing their reasoning, making it impossible to detect when deci- sion weights have been poisoned through injected evaluation context. Without reasoning logs, evaluations appear legitimate despite underlying decision logic being compromised. RTM53 - Cross-Agent Evaluation Orchestration Moni- toring Blind Spots. Evaluation orchestration coordinating mul- tiple evaluator agents lacks visibility into inter-agent com- munication and control flow routing decisions, preventing detection of control flow hijacking such as skipping validation gates or reordering evaluations. Unlike operational monitoring focused on component health, evaluation orchestration requires monitoring of decision logic. RTM 54 - Evaluation Metric Calculation Opacity in Monitoring. While evaluation results are logged, metric com- putation details such as which accuracy definition was used or which test cases were included are often missing, hiding attacks that exploit ambiguous metric definitions. Evaluation metric monitoring requires semantic visibility into computa- tion logic that current systems do not provide. RTM 55 - No Monitoring of Evaluation Framework Im- plementation Details. Different evaluation frameworks produce results without visibility into their implementation, hiding potential vulnerabilities such as prompt injection in LLM- based evaluators. Evaluation framework monitoring requires understanding implementation-specific vulnerabilities to en- able framework-specific attack detection. RTM 56 - Evaluation Audit Trail Completeness Gaps. Evaluation audit trails show final results without capturing intermediate agent contributions, making it impossible to re- construct which agent’s compromise caused biased evaluation results. Unlike operational audits with clear causality, evalu- ation audit trails must capture agent computation graphs for post-incident investigation. RTM 57 - No Monitoring of Evaluation Dataset Integrity. Evaluation datasets are assumed valid but changes go unmoni- tored, allowing attackers to poison evaluation datasets without leaving an audit trail detectable through normal monitoring. Integrity checking such as checksums and change tracking is absent from current evaluation pipeline monitoring systems. RTM 58 - Evaluation Agent Behavior Baseline Absence in Monitoring. Without baselines for normal evaluation agent behavior, monitoring cannot distinguish legitimate evaluation from attack-driven manipulation by compromised agents. Es- tablishing baselines requires understanding expected patterns to enable anomaly detection currently missing from evaluation monitoring. RTM 59 - Cross-Evaluation Temporal Analysis Gaps. Treating evaluations independently rather than analyzing pat- terns across runs misses temporal attack signals such as scheduled metric improvements indicating systematic evalu- ation gaming. Multi-agent evaluation with multiple contribut- ing agents generates temporal data that could reveal attacks through cross-run pattern analysis. RTM 510 - Evaluation Metric Telemetry Spoofing. Unen- crypted or unauthenticated metric telemetry reporting enables attackers to spoof metric reports making evaluation appear to pass when it is actually failing. In multi-agent systems, a single injection point into centralized telemetry can affect all agents’ monitoring simultaneously. RTM511 - Evaluation Performance Monitoring Blind Spots. Evaluation scripts may not be monitored as carefully as production code, allowing attackers to exploit inefficiencies or trigger resource exhaustion causing evaluation timeouts. In multi-agent evaluation, triggering resource issues in one agent’s evaluation loop can affect overall evaluation infras- tructure. RTM 512 - Audit Trail Integrity Violations Through Evaluation Log Tampering. If evaluation logs are writable by agents or have modifiable timestamps, attackers can tamper with audit trails to make malicious changes appear to have passed prior evaluation runs. Multi-agent shared audit logs enable tampering that affects all agents’ audit trails simul- taneously. RTM 513 - Monitoring Alert Threshold Calibration Eva- sion. Attackers can gradually degrade metrics staying below alert thresholds, causing cumulative undetected degradation. In multi-agent systems with aggregate-based thresholds, degra- dation can be distributed across agents so each stays below individual alert thresholds while collectively degrading quality. RTM 514 - Blind Spots in Metric Correlation Analysis. Evaluation frameworks that do not analyze correlations be- tween metrics allow attackers to degrade multiple metrics in coordinated ways that appear as uncorrelated failures. Multi- agent systems with multiple metrics per agent enable attackers to learn which metric combinations appear suspicious and avoid those while degrading unmeasured quality dimensions. RTM 515 - Benchmark Execution Telemetry Gaps for Attack Concealment. In multi-agent systems, benchmark telemetry is distributed across agent-specific logs with no unified layer, creating monitoring gaps at agent boundaries where inter-agent instruction passing leaves no correlated trace. Single-agent telemetry is continuous within one process, whereas multi-agent telemetry has natural gaps at boundaries enabling attacks that exploit monitoring fragmentation. RTM 516 - User Feedback Monitoring Blind Spots for Attack Attribution. In multi-agent systems, feedback mon- itoring often attributes all multi-agent failures to the final responding agent, preventing identification of which upstream agent or coordinated attack caused the issue. Single-agent feedback monitoring directly attributes issues, whereas multi- agent systems create monitoring blind spots enabling dis- tributed attacks to hide responsibility. RTM 517 - Performance Metric Monitoring Blind Spots for Gradual Degradation. In multi-agent systems, gradual coordinated degradation of multiple agents simultaneously can create compound effects that exceed monitoring thresholds without any single agent’s individual degradation triggering an alert. Single-agent degradation triggers monitoring di- rectly, whereas multi-agent coordinated degradation exploits distributed monitoring that cannot correlate gradual compound effects. 6) RTM 6 - Metrics Collection and Manipulation Eva- sion: RTM 61 - Approval Workflow Audit Trail Frag- mentation for Attack Concealment. In multi-agent approval systems, audit trails fragment across agents with no unified chain enabling complete decision tracing, creating blind spots for attacks spanning agent boundaries. Single-agent approval audit trails are continuous, whereas multi-agent trails split at boundaries enabling attacks that exploit audit discontinuity. RTM62 - Temporal Synchronization Gaps in Multi- Agent Web Navigation. Multi-agent web navigation coordi- nating across agents creates temporal gaps where page state changes between agent actions, enabling attackers to inject instructions during timing windows. Single-agent navigation sees consistent state, whereas multi-agent coordination across temporal boundaries creates injection opportunities through timing gaps. RTM 63 - Metric Collection Parameter Tuning Creating Monitoring Gaps. Asymmetric monitoring parameter config- urations across agents create blind spots where agents with reduced instrumentation hide behavior that comprehensively traced agents would reveal. Attackers exploit monitoring- parameter asymmetry by operating through agents with re- duced instrumentation. RTM 64 - Confidence Score Tuning as Metric Manipu- lation Surface. Attackers can tune confidence generation pa- rameters specifically for monitoring evasion, producing high- confidence wrong answers that appear acceptable to automated monitoring. Multi-agent monitoring that aggregates confidence across agents becomes corrupted when individual agents tune confidence parameters for metric appearance optimization. RTM65 - Latency Metric Gaming Through Optimization Parameter Selection. Attackers can craft operations that hit optimized code paths to appear fast under latency monitoring while executing malicious logic, hiding malicious behavior within tuned latency boundaries where operations appear normal-speed. Latency optimization parameters that create favorable metrics enable attackers to exploit the resulting monitoring blind spots. RTM 66 - Demonstration Ordering as Covert Instruction Activation Mechanism. Adversaries can strategically position poisoned examples at the end of demonstration sequences to exploit recency bias, ensuring maximum influence on learned patterns. In multi-agent systems where demonstration sets flow across boundaries, careful ordering can position malicious examples at critical junctures where they exert maximal influ- ence while escaping monitoring systems focused on explicit injection rather than ordering-based control flow. RTM 67 - Distributed Tool Audit Log Analysis De- feating Through Async Aggregation. Attackers can exploit asynchronous log aggregation timing by committing attacks before logs have been correlated, or crafting attack sequences that appear safe in isolated time windows but malicious when correlated across agents. Singular agent logs are analyzed atomically, whereas multi-agent asynchronous aggregation cre- ates analysis windows enabling evasion of temporal correlation detection. RTM 68 - Tool Invocation Observability Reduction Through Delegation. In agent delegation hierarchies, tool invo- cations by worker agents do not directly trace to user requests, creating semantic gaps where audit trails show tool calls with- out the full context of why they were invoked. Singular tracing connects users directly to invocations, whereas hierarchical delegation creates gaps between original user requests and downstream tool calls. RTM 69 - Tool Response Quality Metrics Poisoning Through Aggregation Bias. Attackers can compromise a subset of agents to report inflated quality metrics, skewing aggregate metrics used for decisions such as retiring low-performing tools. Singular agents report independent metrics, whereas multi-agent aggregation creates bias attack surfaces where compromising a subset affects collective quality perception. RTM 610 - Tool Selection Monitoring Blind Spots Through Agent Specialization. Different agents have different tool palettes, and per-agent monitoring misses cross-agent tool selection patterns. Attackers exploit this by selecting specific tool sequences across agent boundaries that avoid triggering single-agent monitors while achieving malicious objectives. RTM 611 - Entropy Tracking Evasion Through Agent Confidence Aggregation. In multi-agent systems, high- confidence downstream validation can mask high-entropy un- certain upstream generation, making hallucination detection based on entropy monitoring blind to the underlying attack. Singular entropy tracking captures generation uncertainty, whereas multi-agent aggregation masks it through downstream confidence. RTM 612 - Tool Audit Coverage Gaps Through Asyn- chronous Validation. When tools are invoked by one agent and validated asynchronously by another, compromised tools can execute many times before validation occurs, creating coverage gaps. Singular synchronous validation prevents this, whereas multi-agent asynchronous validation creates windows where tools execute without immediate oversight. RTM 613 - Cross-Agent Context Correlation Blindness in Anomaly Detection. Individual agents’ invocation patterns may appear normal while cross-agent correlations are anoma- lous, allowing attackers to coordinate across agents that each appear normal individually but are collectively executing an attack. Singular anomaly detection operates on a single stream, whereas multi-agent systems require stream correlation that current systems lack. RTM 614 - Action Accuracy Metrics Not Captured in Production Monitoring. Multi-agent systems often log execu- tion per agent but do not compute aggregated action accuracy metrics across agent chains, creating monitoring gaps where accuracy degradation at agent boundaries goes undetected. Single agents with comprehensive action logging have di- rect visibility into accuracy degradation, whereas multi-agent pipelines with per-agent logging but no cross-agent metrics have blind spots where boundary-level degradation persists undetected. RTM 615 - Parameter Validation Failures Undetected in Aggregated Metrics. Aggregated accuracy metrics across agents can hide parameter-type-specific failures where one agent performs poorly on a specific parameter category while overall aggregate appears acceptable. Single agent granular metrics are directly observable, whereas multi-agent aggre- gation obscures which agent or parameter type is degrading, which is critical because systematic parameter-specific attacks can hide within acceptable overall accuracy. RTM616 - Tool Execution Errors Hidden in Aggregated Success Rates. Tool execution success rates aggregated by tool rather than by agent hide agent-specific parameter accuracy problems, making a systematically failing agent appear as a tool reliability issue rather than an agent-level problem. Multi- agent monitoring blind spots prevent diagnosing root causes of execution failures. RTM 617 - Multi-Turn Consistency Losses Undetected Across Agent Chains. Multi-agent systems measure per-agent turn consistency but not cross-agent consistency, so degrada- tion in one agent’s session coherence can affect parameters received by downstream agents without detection. Cross-agent coherence monitoring is missing in most multi-agent systems, creating undetected reliability degradation across agent chains. RTM 618 - Error Recovery Patterns Invisible in Dis- tributed Tracing. Distributed error recovery involving cross- agent coordination creates recovery blindness where monitor- ing systems do not track whether retry attempts succeeded across the full recovery chain. Single-agent recovery is directly observable, whereas multi-agent recovery involving cross- agent coordination creates blind spots where locally successful recovery may deliver incomplete recovery state to downstream agents. RTM 619 - Cross-Agent Trajectory Metrics Rarely Com- puted. Trajectory metrics requiring complete action sequences from start to finish are rarely computed across agent bound- aries in multi-agent systems, creating trajectory blindness where action sequence quality across agent chains is un- measured. Single-agent trajectory evaluation is straightfor- ward, whereas multi-agent trajectories with concurrent and asynchronous operations make reference trajectory definition ambiguous. RTM 620 - System-Level Coherence Validation Blind Spot. While individual agents are evaluated for reasoning quality, no mechanism validates multi-agent system-level rea- soning coherence across agent boundaries, enabling attacks where each agent’s local reasoning is sound but system-wide reasoning breaks. System-level coherence is an emergent prop- erty of multi-agent interaction that individual agent evaluation cannot detect. RTM 621 - Reasoning Quality Drift in Production With- out Continuous Monitoring. Organizations that evaluate rea- soning quality in development but lack continuous produc- tion monitoring create blind spots where reasoning quality gradually degrades undetected, and in multi-agent systems degradation in one agent cascades through downstream agents amplifying impact. RTM 622 - Reasoning Quality Evaluation Scope Limita- tions. Reasoning quality evaluation frameworks often focus on happy-path reasoning without extensively testing error conditions or adversarial scenarios, leaving untested collapse conditions that attackers can exploit. In multi-agent error handling, reasoning quality collapse in one agent during anomalous conditions can cascade to downstream agents that inherit degraded reasoning without expecting it. RTM 623 - Attribution and Traceability Gaps in Reason- ing Chains. Organizations lack mechanisms to trace reasoning contributions back to specific agents in multi-agent systems, preventing identification of which agent’s reasoning failure caused system-level problems and enabling attackers to inject reasoning into intermediate agents where attribution gaps prevent detection. Singular agents’ reasoning is traceable to single sources, whereas multi-agent systems create attribution ambiguity that enables injections to hide in the gaps. RTM 624 - Efficiency Metric Aggregation Obscuring Attack Signals. Aggregating efficiency metrics across multiple agents, operations, and time windows obscures per-agent or per-operation attack signals where malicious behavior causing small degradation disappears in aggregate metrics. Single- agent metrics aggregated over time hide temporal attacks, whereas multi-agent aggregation further hides per-agent at- tacks within system-level metrics. RTM 625 - Sampling-Based Efficiency Monitoring Cre- ating Blind Spots. High-volume systems that sample efficiency metrics enable attackers to craft operations that trigger only under unsampled conditions, making malicious efficiency be- haviors invisible. Multi-agent systems with coordinated sam- pling across agents allow attackers who understand sampling boundaries to craft attacks outside monitored operations. RTM 626 - Latency Percentile Reporting Masking Attack Spikes. Reporting latency percentiles rather than extremes leaves attack-triggered spikes affecting only a small fraction of operations invisible in standard percentile metrics. Multi-agent systems reporting aggregate percentiles across agents hide per- agent tail latencies even more thoroughly than single-agent percentile reporting. RTM 627 - Cost Attribution Lag Creating Attribution Blind Spots. Cost attribution that lags actual usage by hours or days enables attackers to exhaust resources before cost attribution reveals the problem. Multi-agent systems with shared resource pools enable attackers to exhaust all agents’ shared resources during the attribution lag before detection occurs. RTM 628 - Efficiency Alert Thresholds Missing Gradual Degradation. Discrete alert thresholds miss gradual resource degradation that stays below thresholds while cumulatively exhausting budgets. Multi-agent systems with independent per- agent thresholds enable coordinated gradual degradation across all agents where no single agent’s alert triggers system-wide awareness. RTM 629 - Efficiency Metric Correlation Analysis Blind Spot. Monitoring individual efficiency metrics in isolation misses coordinated attack signals visible only when simulta- neous anomalies across multiple metrics are correlated. Multi- agent systems without cross-agent metric correlation miss coordinated attacks where each agent’s metrics appear normal but correlation reveals the attack pattern. RTM630 - Historical Baseline Staleness Creating False Negatives. Efficiency baselines that become stale as systems evolve miss degradation that would be anomalous against current operational norms. Multi-agent systems with shared baselines enable attackers who poison those shared baselines to render all agents’ monitoring ineffective simultaneously. RTM 631 - Telemetry Processing Latency as Detection Evasion Window. Asynchronous telemetry processing intro- duces detection lag that attackers can exploit by executing attacks faster than monitoring can detect and respond. Multi- agent systems where attacks exploit lag across multiple agents enable rapid coordinated failures that complete before dis- tributed monitoring detects the anomalies. RTM 632 - Efficiency Metric Instrumentation Coverage Gaps. Not all operations are instrumented for efficiency mon- itoring, and attackers identify and exploit unmonitored code paths. Multi-agent systems with partial instrumentation enable attackers targeting specific agents whose operations lack in- strumentation, keeping attacks invisible to overall monitoring. 7) RTM 7 - Infrastructure and Observability Stack Blind Spots: RTM 71 - Tool Behavior Attribution Loss in Multi- Agent Calls. When multiple agents share tools, monitoring cannot attribute tool behavior such as latency spikes to specific originating agents, obscuring attacks by individual agents. Single-agent tool calling has clear attribution, whereas multi- agent tool sharing creates attribution ambiguity that attackers can exploit. RTM 72 - Message Queue Consumer Lag Hiding Agent Processing Failures. High consumer lag in shared message queues can indicate both high throughput and processing fail- ures, and without per-agent lag breakdown, monitoring cannot identify which agents are failing. Singular agent consumer lag directly maps to that agent’s performance, whereas multi-agent shared queues hide individual agent failures in aggregate lag metrics. RTM 73 - Vector Database Query Latency Hiding Se- mantic Drift. Vector database latency metrics appear normal even when retrieval quality has degraded due to poisoned embeddings or index staleness. In multi-agent systems sharing a vector database, coordinated semantic drift affecting all agents’ RAG results goes undetected when monitoring only measures latency. RTM 74 - Prometheus Scrape Success Rate Hiding Agent-Level Failures. A successful Prometheus scrape of an agent’s metrics endpoint does not distinguish between a healthy agent and a malfunctioning agent exposing incorrect data. Multi-agent systems create blindness about which agents are truly functioning when scrape success is used as a proxy for agent health. RTM 75 - API Gateway Request Success Rate Hiding Tool Invocation Failures. HTTP success codes do not distin- guish between requests that actually succeeded and those that returned error messages within a successful HTTP response. Multi-agent systems where gateways track aggregate success rates across all agents create blindness where tool failures invisible in HTTP status codes affect large fractions of traffic. RTM76 - MLflow Deployment Success Hiding Model Performance Regressions. Successful deployment events do not indicate that deployed models maintain performance com- pared to previous versions, creating a blind spot until user impact appears. Multi-agent systems deploying models for multiple agents simultaneously amplify this blind spot, with fleet-wide regression appearing as deployment success. RTM 77 - Message Queue Throughput Metrics Hiding Quality Degradation. High message throughput metrics mask content quality issues when poisoned messages are processed at high volume. Multi-agent shared queues enable fleet-wide quality degradation invisible in aggregate throughput metrics. RTM 78 - Prometheus Alert Suppression Creating Cog- nitive Behavior Blindness. Alert suppression prevents repeated firing for ongoing issues, causing orchestrators that make decisions based on alert presence to assume issues are re- solved when suppression merely hides recurrence. Multi-agent systems where orchestrators make fleet-wide decisions based on suppressed alerts face blind spots that affect all dependent agents. RTM 79 - API Gateway Rate Limit Exhaustion Hiding Tool Timeout Issues. Rate limit responses can mask underlying tool timeouts, creating a misdiagnosis where a tool infrastruc- ture failure appears as a traffic management issue. Multi-agent systems where one tool timeout triggers rate limit backlog for all agents compound this blind spot. RTM 710 - MLflow Metrics Aggregation Hiding In- dividual Agent Regressions. MLflow aggregate metrics that average across agents can show overall improvement while hiding severe regression in specific agents. Multi-agent shared MLflow aggregation creates blind spots where outlier agent degradation disappears in aggregate statistics. RTM 711 - Monitoring Agent Metrics Aggregation Skewing Real Behavior. Aggregation operations such as av- erages and percentiles across multi-agent metrics can ob- scure outlier agent behaviors by averaging anomalous agents with normal ones. Compromised agents exhibiting instruction- injected behavior remain undetected if their metric deviation averages within normal fleet variance. RTM 712 - Alert Fatigue from Pod-Level Metrics vs Service-Level Metrics. Multi-agent deployments generate pod- level alert volumes that can overwhelm operators and enable attackers to hide malicious service-level behavior beneath be- nign pod-level alert noise. Single-agent pod alerts are manage- able, whereas multi-agent deployments create alert explosions potentially drowning out meaningful anomalies. RTM 713 - Canary Metric Evaluation Blind Spots via Insufficient Sample Size. Multi-agent deployments distribute canary samples across agents, potentially resulting in per- agent sample sizes too small for statistical significance testing, missing agent-specific degradation that would be detectable with adequate single-agent sample sizes. RTM 714 - Distributed Tracing Performance Overhead Creating Instrumentation Bias. Comprehensive distributed tracing overhead may cause heavily-instrumented agents to behave differently than lightly-instrumented agents, creating test-production divergence and obscuring actual multi-agent interaction effects. Single-agent overhead is uniform, whereas multi-agent heterogeneous instrumentation creates behavioral divergence. RTM715 - Observable Metrics Obscuring Non- Observable Internal Agent States. External metrics cannot directly reveal internal agent state such as reasoning validity, confidence scores, or memory corruption, and in multi-agent systems internal state corruption in one agent propagates to downstream agents invisibly. Single-agent internal corruption affects one agent’s reasoning, whereas multi-agent propagation makes corruption detectable only through eventual external metric degradation after traversing multiple agents. RTM 716 - Log Aggregation Timestamp Skew Prevent- ing Accurate Causality Reconstruction. Distributed agents with unsynchronized clocks create timestamp skew enabling attack- ers to craft events with manipulated timestamps that falsely implicate innocent agents during incident investigation. Multi- agent systems aggregating logs from multiple agents with independent clocks create multiple skew sources unavailable in single-agent logging. RTM 717 - Prometheus Metrics Cardinality Explosion Enabling Metric-based Denials of Service. Unbounded metric cardinality in multi-agent systems can enable attackers to cause cardinality explosion by triggering all agents to generate high-dimensionality metrics, overwhelming Prometheus and causing fleet-wide monitoring blind spots. RTM 718 - Missing Metrics for Multi-Agent Coordina- tion Latency. Standard monitoring tracks per-pod metrics but not inter-pod communication latency for multi-agent coordi- nation, enabling attackers to degrade inter-agent coordination without triggering standard latency alerts. RTM 719 - Tool Invocation Audit Log Blind Spots in Service Mesh. Service mesh logs capture network calls but not the semantic content of operations performed, enabling evasion of semantic operation audit. Multi-agent coordination through service mesh creates semantic gaps where logs show endpoint calls without auditing the instructions passed. RTM 720 - Grafana Dashboard Bias Toward Healthy States. Dashboards displaying aggregate metrics hide outlier agent behavior, allowing attackers to compromise specific agents while aggregate metrics remain normal. Multi-agent ag- gregate dashboards hide individual agent compromises within fleet-level averages. RTM 721 - Alert Rule Suppression Through Metric Threshold Manipulation. Attackers can suppress alerts by ma- nipulating metrics from specific agents to stay below thresh- olds while other agents experience cascading effects invisible in the alerted metrics. Multi-agent alert rules depending on coordinated metrics from multiple sources create suppression attack surfaces unavailable in single-agent systems. RTM 722 - Audit Log Asynchronous Write Latency Creating Compliance Blind Spots. Asynchronously written audit logs can be lost if agents crash before flushing, and attackers can trigger crashes immediately after malicious oper- ations to prevent log persistence. Multi-agent systems enable coordinated pod crashes across agents to eliminate distributed audit trail records simultaneously. RTM 723 - Container Registry Audit Log Blind Spots for Layer Poisoning. Container registries track image pushes but not semantic validation of layer content, so poisoned layers go undetected in audit logs. Multi-agent deployments pulling shared images enable attackers to poison registry layers affecting all agents without semantic-level audit detection. RTM 724 - Kubernetes API Server Audit Log Cardinality Overload. Multi-agent systems with high API call frequency can create audit log volumes that cause operators to disable detailed logging, creating blind spots that hide attacks in disabled audit trails. RTM 725 - Profiling Blind Spot: Tools Executing During GPU Idle Periods. Multi-agent systems create complex timing patterns where tool execution on one agent overlaps with GPU utilization on another, making detection of attacks during GPU idle periods difficult when distributed across agents. RTM 726 - Tracing Overhead as Observability Paradox. Profiling overhead changes execution patterns, creating diver- gence between observed and unobserved production behavior. Multi-agent systems with asymmetric profiling create observ- ability asymmetry where monitored agents behave differently than unmonitored ones, making cross-agent behavior verifica- tion impossible. RTM727 - Metric Aggregation Masking Agent-Specific Anomalies. Aggregated metrics across multi-agent fleets mask individual agent anomalies when other agents’ normal perfor- mance compensates. Single-agent systems reveal all anomalies directly, whereas multi-agent aggregation enables malicious agents to hide behavior within aggregate statistics. RTM 728 - MLflow Logging Gaps in Distributed Op- timization. Distributed optimization decisions made through agent-to-agent communication may occur outside monitored channels if participating agents do not explicitly log to MLflow. Multi-agent decision propagation creates blind spots in centralized telemetry where coordination occurs off-log. RTM 729 - Speculative Decoding Token Prediction Opacity. Speculatively generated but rejected draft tokens that do not appear in output logs can still influence downstream probability calculations, creating a monitoring blind spot. In multi-agent systems, agents consuming speculative decoding output receive probability distributions influenced by rejected predictions, with monitoring systems unaware of the rejected- but-influential tokens. RTM730 - Profiling Data Retention and Forensic Gaps. Brief profiling data retention due to storage constraints cre- ates forensic gaps where attacks occurring between profiling windows leave no evidence. Multi-agent systems making inter- mittent profiling decisions at fleet level enable timing attacks synchronized to profiling gaps across all agents. RTM 731 - Inference Latency Spikes Masked by Batch- ing Indeterminism. In multi-agent deployments, legitimate latency variations from dynamic batching mask marginal ma- licious latency increases that remain undetected within normal batching variance. Unlike singular deployments with pre- dictable latency patterns, multi-agent batching indeterminism creates monitoring blind spots. RTM732 - Queue Depth Metrics Blind Spot in Multi- Agent Orchestration. Monitoring only sees inference-level queue depth while orchestration-level queuing between agents is invisible, enabling attackers to create orchestration dead- locks that appear as normal inference queuing. Unlike singular systems with observable queues, multi-agent systems have distributed queuing invisible to aggregate monitoring. RTM 733 - Error Rate Aggregation Masking Multi- Agent Failure Patterns. Fleet-wide error rate aggregation can dilute individual agent error rate increases below alert thresh- olds, enabling targeted attacks on specific agents that remain invisible in aggregate metrics. Unlike singular systems where error rates directly indicate problems, multi-agent aggregation creates distributed attack invisibility. RTM 734 - Token Generation Metrics Absence in Multi- Agent Throughput Analysis. Request-per-second metrics with- out token-per-second granularity hide actual computational load variations, enabling attackers to exploit the throughput metric blind spot. Multi-agent systems lack the token-level granularity available in singular deployments, creating ex- ploitable measurement gaps. RTM 735 - Cross-Agent Correlation Absent from Stan- dard Monitoring. Standard per-service metrics without cross- service correlation dashboards miss attack propagation pat- terns visible only when one agent’s spike is correlated with another’s failure. Most monitoring stacks lack native multi- agent correlation, causing distributed attacks to manifest as independent service issues rather than coordinated campaigns. RTM 736 - GPU Telemetry Insufficient for Detecting Quantization-Based Attacks. Standard GPU metrics do not reveal quantization corruption, precision loss propagation, or KV cache poisoning, which occur silently within GPU compu- tations without triggering utilization or thermal alerts. Multi- agent Fleet Command monitoring aggregating from hundreds of edge locations creates multiple independent blind spots where such attacks progress undetected. RTM 737 - Engine Metadata Drift Undetectable Without Binary Inspection. TensorRT engines are opaque binaries without runtime visibility, and file system tampering or silent corruption is invisible to standard telemetry unless binary hashes are explicitly validated. Multi-agent deployments with hundreds of cached engines make continuous binary validation impractical at scale, enabling engine tampering to go unde- tected. RTM 738 - Quantization Artifact Telemetry Absence. Standard monitoring lacks telemetry for quantization-specific metrics such as activation range distribution or per-layer precision loss, leaving an entire class of quantization-based attacks invisible to Fleet Command telemetry. Multi-agent systems lack quantization visibility across all agents, creating a systematic monitoring blind spot for this attack class. RTM 739 - Cross-Agent Coordination Timing Blind Spots. Per-agent latency monitoring cannot detect cross-agent timing patterns where specific latency conditions in one agent trigger malicious behavior in downstream agents. Multi- agent coordination creates timing windows that are exploitable through boundary propagation and invisible to individual-agent telemetry. RTM740 - Model Update Validation Telemetry Gaps. Post-deployment health checks cannot detect latent backdoors in quantized engines that pass functionality checks when their trigger conditions have not been activated. Multi-agent Fleet Command deployments validating health across hundreds of locations simultaneously face resource constraints preventing comprehensive latent backdoor detection. RTM 741 - Load Balancer Routing Metrics Obscur- ing Agent-Level Behavior. Monitoring at load balancer level shows aggregate traffic distribution but obscures individual agent behavior, hiding attacks affecting specific replicas in aggregate metrics. Single-agent monitoring is at agent level, whereas load-balanced systems aggregate across replicas cre- ating per-agent blind spots. RTM 742 - Batching Obscuring Tool Invocation Patterns. Tool invocations within batches do not expose individual invocation patterns in request logs, allowing dangerous tool se- quences to be hidden within batch processing. Unbatched tool invocations are directly observable, whereas batching creates pattern obscurity requiring deep batch-internal monitoring. RTM 743 - Caching Creating Hit/Miss Monitoring Blind Spots. Cached queries that do not invoke underlying tools appear as no tool usage in monitoring, creating tool invocation observability gaps. Fresh queries show tool invocations clearly, whereas caching makes previously invoked tool executions invisible to monitoring. RTM 744 - Load Balancer Session Affinity Hiding Cross-Replica Attack Propagation. IP hash routing that con- fines sessions to single replicas hides cross-replica communi- cation, and malware propagating through load balancer routing becomes invisible in per-replica logs. Direct inter-agent com- munication is observable, whereas load balancer mediation hides propagation in routing decisions. RTM 745 - Auto-Scaling Configuration Blind Spots. Auto-scaling adds new replicas that may have different mon- itoring configurations, creating coverage gaps and inconsis- tency as fleets grow. Static fleets have consistent monitoring, whereas auto-scaling introduces coverage inconsistency pre- venting complete telemetry visibility. RTM 746 - Dynamic Load Balancer Metrics Poisoning Affecting Observability. Attackers who poison dynamic load balancer metrics create misleading observability for systems that rely on those metrics for routing decisions. Systems with- out load balancer metric exposure are not vulnerable to this poisoning, whereas dynamic routing creates an observability corruption attack surface. RTM 747 - Streaming Response Monitoring Complexity. Streaming responses in batched contexts create monitoring scenarios where batch boundaries do not align with response boundaries, preventing clear per-request attribution. Atomic batch responses are clearly bounded, whereas streaming cre- ates temporal monitoring complexity requiring sophisticated log correlation. RTM748 - Cost Telemetry Attribution Opacity in Dis- tributed Batching. Batch processing distributes cost across batch members without clear per-agent attribution, enabling agents to hide expensive operations within batches. Single- agent costs are directly attributed, whereas distributed batch- ing creates cost attribution opacity exploitable for economic obfuscation. 8) RTM 8 - Reasoning and Cognitive State Monitoring: RTM 81 - Reasoning mutation defeating anomaly detection. Chain-of-thought traces can be semantically preserved while syntactically modified, such as rewording steps to change surface form while maintaining attack intent, defeating pattern- based detection. In multi-agent systems monitoring CoT rea- soning across multiple agents, semantic variations of the same attack are invisible to syntactic detection. RTM 82 - Coordination intent invisibility in distributed reasoning. When multiple agents’ reasoning traces are only visible separately, coordinated attack patterns that span agents remain invisible because each individual trace appears benign. Single-agent monitoring can see complete intent in one trace, whereas multi-agent systems cannot detect coordinated intent distributed across multiple agents’ reasoning. RTM 83 - Reasoning state obfuscation. Agents can ex- press the same underlying compromised decision through different reasoning structures, making behavior comparison across agents difficult. Multi-agent systems face semantic matching problems when checking consistency across different agents’ reasoning structures that a single-agent system does not encounter. RTM 84 - Meta-reasoning blind spot. Agents may in- clude reasoning-about-reasoning in their traces that explicitly conceals certain decision factors from monitoring, creating recursive structures that monitoring systems cannot parse. In multi-agent systems where one agent’s hidden reasoning af- fects other agents’ behavior, this creates end-to-end monitoring blind spots. RTM 85 - Reasoning latency sidechannels in coordina- tion. Timing information about reasoning trace generation and retrieval encodes state information that attackers can use to infer when attacks succeeded. In multi-agent systems where agents wait for each other’s reasoning, coordinated latency patterns reveal attack progress that single-agent latency would not expose. RTM86 - ToT search pattern analysis enabling behavior prediction. Logging tree-of-thought search patterns enables attackers to reverse-engineer agent decision logic and predict future plans. Multi-agent ToT systems generate telemetry across all agents’ search activities, making reverse-engineering more effective than with localized single-agent patterns. RTM 87 - Preserved Path Instrumentation Blind Spots. Preserved reasoning paths may not be subject to the same telemetry collection as real-time reasoning execution, and when downstream agents retrieve and execute preserved paths, the execution lacks telemetry linking it to the original genera- tion. Multi-agent preserved path usage across agent boundaries creates blind spots where downstream execution of upstream preserved paths lacks cross-agent visibility. RTM 88 - Multi-Path Reasoning Telemetry Aggregation Blind Spots. Aggregated telemetry reporting only summary statistics across multiple reasoning chains hides path-specific anomalies where individual paths contain injected instructions. Multi-agent telemetry where multiple agents’ paths mix in aggregated metrics creates blind spots hiding individual agent anomalies within combined summary statistics. RTM 89 - Quality Score Metric Blind Spots in Safety Monitoring. Malicious quality score inflation remains un- detected when safety monitoring focuses on output content without examining quality scoring methodology. Multi-agent systems with heterogeneous quality metrics create blind spots where individual agent metric manipulation disappears in cross-agent aggregation. RTM 810 - Sampling Parameter Monitoring Blind Spots. If monitoring does not track which sampling parameters were used for each execution, attacks that succeed under specific pa- rameter configurations but not others create undetectable blind spots. Multi-agent systems with heterogeneous parameter con- figurations create blind spots where individual agent parameter vulnerabilities become invisible in aggregate monitoring. RTM811 - Confidence Score Monitoring Blind Spots From Voting Mechanism Opacity. Receiving only final con- fidence scores without voting distribution detail loses infor- mation about consensus strength, allowing attackers to game voting to produce high-confidence outputs from weak con- sensus. Multi-agent confidence aggregation loses voting detail completely, creating fleet-wide blind spots about consensus quality. RTM 812 - Consolidated Memory Usage Monitoring Blind Spots. Monitoring focused on memory retrieval out- comes without visibility into which consolidated points were accessed leaves exploitation of consolidated memory back- doors undetectable. Multi-agent systems sharing consolidated memory lose cross-agent access patterns when consolidation- level monitoring is absent. RTM 813 - Streaming Response Monitoring Blind Spots in Multi-Agent Handoffs. If monitoring captures only final outputs without streaming-level detail, instruction injection through streaming handoffs between agents remains hidden. Multi-agent streaming handoffs create blind spots at agent boundaries where injection points lack instrumentation. RTM 814 - Decomposition Trace Logging Gaps in Multi- Agent Hierarchies. Decomposition traces often remain within individual agents without central visibility, creating monitor- ing blind spots where invalid decompositions may execute without early detection. Multi-agent systems with distributed decomposition lack centralized trace collection, creating gaps unavailable in single-agent systems. RTM 815 - Partial Order Execution Monitoring Without Complete Ordering Information. Monitoring systems that lack visibility into partial order semantics appear to show deter- ministic execution when underlying decompositions permit non-determinism that attackers can exploit. Multi-agent order- ing execution obscures ordering semantics from monitoring, whereas single agents know their own ordering constraints. RTM816 - State Abstraction Projection Loss in Monitor- ing Context. Each agent in a multi-agent hierarchy monitors at its own abstraction level, creating blind spots where problems hide in abstraction gaps between strategic-level abstract state and concrete operational state. Single agents maintaining both concrete and abstract state visibility can detect abstraction- hidden problems, whereas multi-agent hierarchies cannot. RTM 817 - Method Selection Monitoring Lacking Fail- ure Prediction. Current monitoring logs which methods exe- cute but does not flag suboptimal selections that do not im- mediately fail, missing gradual degradation from poor method choices. In multi-agent hierarchical systems, selection quality assessment is difficult because each agent makes selections based on incomplete information. RTM 818 - Precondition Failure Modes Not Monitored. In multi-agent hierarchies where one agent checks precon- ditions and another executes methods, the executing agent has no independent visibility into whether preconditions were actually satisfied, creating blind spots where precondition failures propagate undetected. Single agents can self-check preconditions, whereas multi-agent division of responsibility creates monitoring gaps. RTM819 - Decomposition Correctness Validation Lack- ing Fallback Checks. No agent in a multi-agent hierarchy has complete responsibility for validating whether selected meth- ods actually achieve the abstract goal, creating correctness failures that lack monitoring detection. Single agents could self-validate decomposition correctness, whereas multi-agent systems create distributed validation gaps. RTM 820 - Cross-Agent Constraint Conflict Detection Blind Spot. When one agent specifies constraints and another executes tasks, there is no monitoring verification that the exe- cuting agent respects the specifying agent’s constraints. Multi- agent systems with constraints spanning agent boundaries lack cross-agent constraint compliance monitoring, relying on trust rather than verification. RTM 821 - MCTS Tree Statistics as Hidden Cognitive State. MCTS tree statistics representing the agent’s cognitive state are rarely logged or monitored, and attackers accessing these internal statistics can extract detailed planning intentions and exploration patterns. Multi-agent systems that log planning statistics for coordination expose hidden cognitive state across agent boundaries. RTM 822 - Simulation Trace Visibility as Behavioral Blind Spot. MCTS simulation traces containing extensive exploration of dangerous actions remain internal and invisible to monitoring, which sees only the executed action, missing that dangerous exploration occurred. Multi-agent systems with trace logging for debugging can expose these traces to central- ized monitoring, but most agents’ simulations go unmonitored. RTM 823 - Rollout Policy Drift as Unobserved Behavior Change. Rollout policy evolution in adaptive MCTS systems happens without explicit monitoring, enabling attackers to force policy drift toward malicious behaviors while monitoring systems detect nothing. Multi-agent systems sharing rollout policies enable one compromised policy to drift and affect multiple agents with monitoring blind spots across all of them. RTM 824 - Convergence Failures as Unmonitored Plan- ning Breakdowns. MCTS planning quality can silently degrade without alerts when convergence fails due to insufficient budget or value function errors. Multi-agent systems where one agent’s convergence failure causes downstream planning problems create cascading unmonitored failures with invisible root causes. RTM 825 - Framework-Induced Telemetry Gaps in LangGraph MCTS Integration. LangGraph checkpointing logs only checkpoint creation and restoration without examining MCTS tree contents, leaving poisoned tree states (modified Q values, visit counts, or structure) as unmonitored attack sur- faces. Multi-agent systems with shared checkpointing across framework boundaries create multiple monitoring blind spots where tree modifications go undetected. RTM 826 - Replanning Attack Obfuscation via Normal Variation. Attackers can inject slow subtle heuristic degra- dation indistinguishable from natural performance variation, causing replanning to gradually favor attacker-preferred paths without triggering monitoring alerts designed for sudden anomalies. Multi-agent systems aggregate monitoring data across agents, where individual agent anomalies are masked by team-level averaging enabling coordinated slow attacks undetectable at per-agent granularity. RTM 827 - Contingency Activation Blind Spots. At- tackers can corrupt contingency branch conditions to activate contingencies frequently while appearing legitimate, because monitoring focuses on unexpected triggers rather than examin- ing whether normal-appearing activations are authentic. Multi- agent systems cannot easily distinguish legitimate coordinated contingency activation from compromise-driven activation, as synchronized contingency use may appear identical in both cases. RTM 828 - Search Tree Expansion Rate Blinding. Mon- itoring of nodes expanded per replanning cycle may miss incremental heuristic degradation that increases search tree size gradually enough to be attributed to harder planning problems rather than attacks. Multi-agent aggregate search expansion metrics mask individual agent degradation when team averages remain within normal bounds. 9) RTM9 - Memory Systems and Knowledge Base Ob- servability: RTM 91 - Episodic Memory Retrieval as Moni- toring Evasion Mechanism. Retrieved episodes influence agent behavior without appearing in logs, enabling attackers to craft episodes that activate behaviors monitoring cannot attribute to specific inputs. Multi-agent systems where one agent retrieves episodes and another monitors actions face attribution blind spots where actions cannot be traced to episode sources. RTM 92 - Consolidation Process Opacity as Learning Blind Spot. Memory consolidation abstracting episodes into semantic rules happens offline and invisibly to monitoring, enabling attackers to craft consolidation processes creating malware templates. Multi-agent organization-wide consolida- tion to shared semantic memory creates organization-scale blindness where transformations of poisoned episodes into shared rules go unobserved. RTM 93 - Trajectory Integration Hiding Multi-Step At- tacks. Monitoring systems observing final outcomes cannot see malicious intermediate steps embedded within trajectories that appear as legitimate problem-solving. Multi-agent shared trajectories used across teams hide malicious steps in shared reference materials, making cross-team detection difficult. RTM 94 - Hybrid Storage Architecture Creating Mon- itoring Gaps. Hybrid systems combining vector and graph databases create dual-channel storage with potentially asym- metric monitoring coverage. Attackers exploit monitoring asymmetries by poisoning under-monitored storage channels such as graph relationships that bypass detection focused on vector content. RTM 95 - Cross-Agent Memory Sharing Obscuring In- dividual Responsibility. When one agent retrieves episodes and another acts on them, monitoring cannot attribute ac- countability to episode creators, enabling unchecked poisoning propagation. Multi-agent episode sharing creates responsibility diffusion absent in single-agent action accountability. RTM 96 - Metadata Filtering Complexity as Detection Evasion. Complex retrieval metadata filtering makes it difficult for monitoring to track which metadata combinations trigger which episodes, enabling attackers to craft poisoned episodes that retrieve only under monitoring-blind metadata configu- rations. Multi-agent systems with aggregated metadata from multiple sources further complicate monitoring of cross-team trigger patterns. RTM 97 - Semantic Memory Query Logging Gaps En- abling Audit Evasion. Performance-constrained query logging creates audit blind spots, and in multi-agent systems with centralized query logging, attackers who detect monitoring can craft queries to avoid logged code paths. Shared logging infrastructure enables attackers to understand which queries are logged and evade collective monitoring. RTM 98 - Retrieval Relevance Monitoring Insufficient for Semantic Validity. Monitoring retrieval relevance provides false confidence because a highly relevant document might contain instructions inappropriate for the query context. Shared relevance metrics provide uniform false confidence across all agents in a multi-agent system. RTM99 - Knowledge Graph Relationship Cardinality Explosion Monitoring Gap. Inference rules creating exponen- tial relationships can cause cardinality explosion invisible in total relationship count metrics until system-wide degradation becomes obvious. Shared graph cardinality explosions affect all agents simultaneously with the problem invisible until it manifests broadly. RTM 910 - Temporal Validity Enforcement Blind Spots. Document age monitoring is insufficient when agents may not check validity annotations, leaving stale documents retrievable despite monitoring indicating they should be expired. Shared enforcement gaps affect all agents and leave stale-document vulnerabilities unsurfaced in collective monitoring. RTM 911 - Embedding Quality Degradation Detection Gaps. Gradual embedding quality degradation from accumu- lated corrupted vectors produces no clear monitoring signal until retrieval accuracy visibly declines. Shared degradation in multi-agent systems affects all agents and requires system- wide monitoring to detect. RTM 912 - Knowledge Base Poisoning Detection Through Anomaly Analysis Gaps. Anomaly detection for knowledge base poisoning requires baselining, but in multi- agent systems with diverse query patterns, establishing base- lines is difficult and poisoning anomalies are hard to distin- guish from normal variation. RTM 913 - Cache Hit Rate Manipulation as Performance Monitoring Bypass. Attackers can artificially inflate cache hit rates by crafting queries matching cached malicious content, providing false confidence about system performance. Shared caches enable attackers to manipulate perceived system health metrics across all agents simultaneously. RTM 914 - Deduplication Metadata Bypassing Com- pleteness Monitoring. Incomplete metadata about deduplicated items causes monitoring based on deduplicated counts to provide an inaccurate picture of knowledge base contents. Shared deduplication creates collective completeness blind spots across all agents. RTM 915 - Working Memory Phase Transitions Creating Monitoring Blind Spots. Working memory lifecycle phase transitions create discrete points where context clears and erases evidence of reasoning paths, intermediate states, and tool invocations before monitoring can capture them. In multi- agent systems, attackers exploit phase transitions by timing attacks to execute during phases where monitoring tools have visibility gaps across agent boundaries. RTM 916 - Token Budget Visualization Creating False Confidence in Monitoring. Token budget dashboards showing healthy per-agent utilization can mask systemic degradation where agents coordinating near combined capacity experience reasoning quality collapse invisible in individual metrics. Multi-agent saturation is an emergent property that per-agent token dashboards cannot reveal. RTM 917 - Reasoning Trace Truncation Hiding Decision Provenance in Multi-Agent CoT. Token limit-driven reasoning trace truncation hides decision provenance when downstream agents inherit outputs with unjustified decisions, and cascading truncations across multi-agent chains progressively eliminate transparency. Monitoring tools analyzing token budgets see efficiency improvements from aggressive truncation while missing the corresponding loss of decision transparency en- abling tool selection abuse. RTM 918 - Hierarchical Compression Observation Opaqueness Creating Semantic Monitoring Failures. Hierar- chical compression stores summaries in working memory while full history resides in external storage rarely inspected for anomalies, and multi-agent compression distributes full history across multiple databases creating monitoring frag- mentation. Coordinated attacks may manifest only in full history analysis comparing details exchanged between agents but appear safe in working memory summaries, requiring correlation across distributed external stores that monitoring platforms do not address. 10) RTM 10 - Decision Logic and Utility Function Mon- itoring: RTM101 - Utility Function Calculation Teleme- try Gaps. Telemetry logs decisions and outcomes without capturing the expected utility calculations underlying them, making it impossible to distinguish decisions from correct utility optimization versus poisoned utility functions. In multi- agent systems, reconstructing distributed utility calculations across agents is impossible without comprehensive internal telemetry capturing intermediate utilities. RTM 102 - Weight-Driven Decision Divergence Blind Spot. Decision divergence across multi-agent systems with different utility weights appears as normal variation rather than indicating attack-injected weight inconsistencies. Moni- toring cannot detect that divergence results from compromised weights rather than legitimate analytical differences. RTM 103 - Probability Distribution Shift Impact on Utility Decisions. Monitoring lacks visibility into how out- come probability distribution changes affect expected utility calculations, continuing to track decision frequency without detecting fundamental utility-calculation changes. Multi-agent probability distribution shifts can cause cascading recalcula- tions across agent networks that monitoring does not correlate. RTM 104 - Specification Gaming Through Utility Metric Redefinition. Agents can appear to achieve utility optimization targets while actually reinterpreting utility function definitions, and telemetry showing target achievement cannot detect se- mantic redefinition. In multi-agent systems, one agent’s redef- inition can propagate through learning mechanisms affecting all agents simultaneously. RTM 105 - Tool Outcome Distribution Telemetry Gaps Enabling Poisoning Detection Failure. Tool success rates and outcome distributions critical for expected utility calculation are not typically monitored, leaving no ground truth to de- tect when attackers poison outcome distribution assumptions. Multi-agent systems with shared tool registries enable uniform outcome distribution poisoning affecting all agents simultane- ously. RTM 106 - Confidence Score Utility Basis Opacity. Confidence scores presented to users or in approval workflows often derive from utility calculations but telemetry does not reveal the computation, hiding cases where negative expected utility is misidentified as confidence. Multi-agent confidence aggregation obscures which agents’ utility calculations con- tributed, enabling targeted poisoning of high-weight agents. RTM 107 - Missing Counterfactual Utility Analysis in Monitoring. Monitoring logs actual decisions and outcomes but not the expected utility of alternative actions, preventing post-incident determination of whether decisions were optimal or represented specification gaming. Multi-agent audit requires analyzing utilities of forgone options across all agents, multi- plying analysis complexity. RTM108 - Rule Firing Monitoring Gaps in Distributed Systems. In multi-agent systems with distributed rule exe- cution, individual agents’ rule firings are not visible in a unified monitoring dashboard, enabling attackers to distribute malicious rule firing patterns across agents in ways invisible to individual monitoring. Single-agent rule firing monitoring shows complete execution, whereas multi-agent distributed execution creates gaps where patterns hide across boundaries. RTM 109 - Working Memory Content Monitoring Gaps. Shared working memory across multiple agents creates opacity about which agents accessed which facts and for what purpose, enabling covert poisoning that exploits unattributable access. Single-agent working memory remains transparent, whereas multi-agent shared working memory obscures access attribu- tion. RTM 1010 - Rule Modification Detection Gaps in Shared Repositories. Rule changes in shared repositories may reach different agents at different stages of rule application, creating inconsistent policy enforcement race conditions that attack- ers can exploit. Single-agent rule modifications are atomic, whereas multi-agent shared rules enable non-atomic modifica- tions creating consistency gaps. RTM 1011 - Heuristic Parameter Tuning Monitoring Blindness. Independent parameter tuning across multi-agent systems makes it difficult to detect when parameters are tuned to enable specification gaming versus legitimate heterogeneity. Single-agent parameter tuning is directly visible, whereas multi-agent diversity creates monitoring challenges. RTM 1012 - Learned Monitoring Evasion Through Training-Based Counter-Strategies. Agents trained under mon- itoring can learn to adjust behavior when monitored while misbehaving when unmonitored, encoding detection evasion strategies in policies that adapt to monitoring changes. Multi- agent systems enable agents to collectively develop coordi- nated evasion strategies. RTM 1013 - Reward Metric Gaming as Learned Moni- toring Evasion. Agents learning from monitored reward met- rics discover gaming strategies that optimize metrics without achieving actual objectives, encoding these as policy compo- nents. Multi-agent coordination enables agents to specialize in gaming different metrics collectively. RTM 1014 - Experience Sampling Bias Detection. Non- uniform experience buffer sampling reveals which experiences are prioritized for training, and attackers observing sampling patterns can infer buffer contents and training focus. Aggre- gated sampling across agents reveals aggregated training focus usable for adversarial planning. RTM 1015 - Policy Output Distribution Analysis as Monitoring. Anomalous action selection probability distribu- tions can indicate adversarial policy influence, but sophisti- cated adversaries can train policies matching benign distribu- tions while embedding hidden triggers. Synchronized policy distributions across agents reveal coordinated attacks that are harder to distinguish from benign distribution changes. RTM 1016 - Gradient Flow Monitoring Limitations for Distributed Learning. Monitoring gradient flows in federated learning can detect anomalies, but sophisticated attackers can craft gradients that appear benign individually while encoding backdoors that activate only after aggregation. Aggregated gradients hide individual agent malice in collective statistics. RTM1017 - Temporal Learning Dynamics Leaking At- tack Signals. Learning curves can expose attack signatures through distinctive convergence patterns, but slow poisoning spread over many iterations hides attack signatures within noise. Aggregated learning dynamics across agents hide in- dividual attack signals. RTM 1018 - Paradigm-Specific Logging Gaps in Hybrid Monitoring. Different hybrid paradigms generate different telemetry types, and no single monitoring approach covers all paradigm-specific telemetry, leaving attackers to operate in paradigm-specific blind spots. Multi-agent hybrid systems require monitoring diverse paradigm types across multiple agents, making complete coverage proportionally more dif- ficult as the product of agents and paradigms grows. RTM 1019 - Knowledge Graph Evolution Telemetry Opacity. Knowledge graph updates lack detailed telemetry tracking why relationships were modified or who authorized changes, leaving minimal audit trails for injected relationships. Multi-agent shared graph monitoring cannot attribute changes to specific agents when multiple agents update simultaneously, creating plausible deniability for attackers. RTM1020 - Cooperative Cycle Intermediate State Blind Spots. Cooperative hybrid architectures iterate through inter- mediate states not captured in final-output-focused monitoring, enabling instruction injection into intermediate states that produces acceptable final outputs. Multi-agent cooperative monitoring cannot fully observe intermediate states distributed across agent boundaries, creating cross-agent injection blind spots. RTM 1021 - Streaming Response Monitoring Gaps in Real-Time Hybrid Output. Multi-agent streaming from mul- tiple agents simultaneously creates a proportionally larger monitoring surface where malicious instructions in one agent’s stream escape detection amidst legitimate streaming from other agents. Single streaming responses are monolithic, whereas multi-agent streaming aggregation creates blind spots within the combined stream. RTM 1022 - Demonstration Curation Audit Trail Opac- ity. Demonstration selection lacks audit trails clearly show- ing what examples were selected and why, enabling unde- tected poisoning of demonstration curation. Multi-agent shared demonstration pools create audit trail opacity where multiple agents’ selections aggregate without per-agent accountability, hiding the fact that a change affected all agents. RTM 1023 - Multi-Paradigm Objective Tracking Coordi- nation Gaps. Hybrid systems track multiple paradigm-specific objectives without unified telemetry, enabling attackers to achieve objective misalignment where no individual metric exceeds thresholds but collective alignment violates specifi- cations. Multi-agent objective tracking requires coordinating metrics across agents and paradigms with no unified dashboard providing this visibility. 11) RTM 11 - Vector Database and RAG Pipeline Teleme- try: RTM 111 - Vector Database Query Quality Metrics Blind Spots in Prometheus Monitoring. Production vector databases expose operational metrics such as query latency and throughput but critically omit retrieval quality metrics that determine whether queries return semantically relevant results, creating false confidence when technical metrics ap- pear healthy while semantic quality has degraded. Without Re- call@k telemetry comparing retrieved results against ground- truth relevance, operators cannot detect retrieval degradation until users report poor results, enabling silent poisoning attacks that gradually degrade quality over weeks. Multi-agent systems amplify this through heterogeneous retrieval requirements, where aggregate metrics mask individual agent retrieval fail- ures when other agents compensate. RTM 112 - Hybrid Search Alpha Parameter Selection Rationale Visibility Gaps. Production systems implementing dynamic hybrid search alpha selection create monitoring blind spots when selection rationale is not logged, making retrieval decisions opaque and unauditable. Multi-agent systems with heterogeneous alpha strategies per agent create blind spots where individual agent strategy manipulation disappears in aggregate monitoring that tracks only final selected values. RTM 113 - Cluster Shard-Level Query Performance At- tribution Gaps in Multi-Node Monitoring. Multi-node vector database clusters aggregate query latency at the cluster level without shard-level or node-level attribution, hiding perfor- mance degradation on specific nodes or shards within ag- gregate metrics. Attackers exploit this by targeting specific shards for poisoning or resource exhaustion knowing aggre- gate monitoring will not isolate the attack, and multi-agent workload heterogeneity further obscures per-shard attribution when different agents query different shards. RTM 114 - Batch Ingestion Error Rate Aggregation Hiding Document-Level Failures. Batch success rate monitor- ing masks document-level failures within successful batches, where significant data loss can occur without alerting if per-batch failure rates remain below thresholds. Multi-agent concurrent ingestion with independent per-agent failure rates creates blind spots in aggregate metrics that obscure which agents experience elevated document failures. RTM 115 - ETL Quality Rejection Metrics Aggregation Hiding Per-Source Data Quality Failures. Aggregate ETL rejection rates mask per-source failure patterns that reveal data quality degradation in specific source systems, preventing targeted remediation. Multi-agent systems with heterogeneous source assignments create blind spots where agent-specific quality issues are averaged into an acceptable overall metric. RTM 116 - Pipeline Transformation Throughput Mon- itoring Blind Spots for Chunk-Level Operations. Document- level throughput metrics miss chunk-level performance charac- teristics that can differ by orders of magnitude, hiding signif- icant transformation bottlenecks within acceptable document- level metrics. Multi-agent systems with heterogeneous doc- ument complexity create further blind spots where per-agent throughput differences appear as expected variation rather than chunk-level performance issues. RTM 117 - Incremental Update Success Metrics Mask- ing Partial Extraction Failures. Run-level ETL success metrics mask partial extraction failures where some sources fail while others succeed, creating knowledge gaps that grow silently across consecutive runs. Multi-agent systems with independent source assignments show aggregate success rates that obscure systematic source failures affecting specific agents’ knowledge freshness. RTM 118 - Quality Metric Aggregation Hiding Per- Dimension Validation Failure Patterns and Source-Specific Quality Degradation. Aggregate quality scores mask per- dimension and per-source failure patterns preventing root cause analysis of quality degradation. Multi-agent systems with heterogeneous data sources create blind spots where agent-specific quality issues disappear in fleet-wide average metrics. RTM 119 - Cache Performance Monitoring Gaps Ob- scuring Per-Layer Hit Rate Degradation and Eviction Pressure. Aggregate cache metrics hide per-layer performance variation and eviction pressure that indicate capacity and quality issues. Production RAG systems with multi-layer caches require per- layer monitoring to detect degradation patterns invisible in aggregate hit rate and memory usage metrics. RTM 1110 - Deduplication Effectiveness Tracking Blind Spots Masking False Positive Inflation and Unique Content Loss. Monitoring deduplication rates without tracking false positive rates hides content loss where unique documents are incorrectly removed. Multi-agent systems reporting aggregate deduplication metrics cannot identify agents with elevated false positive rates causing disproportionate unique content loss. RTM 1111 - Observability Layer Instrumentation Over- head Blind Spots Creating Latency Attribution Gaps. Instru- mentation overhead is not separately measured from applica- tion processing latency, creating attribution gaps that mislead performance optimization. Multi-agent workflows accumulate overhead from each agent’s instrumentation, and aggregate latency cannot be decomposed into application versus observ- ability components without dedicated overhead telemetry. RTM 1112 - Fault Tolerance Monitoring Gaps Hiding Graceful Degradation Mode Frequency and Cascading Failure Patterns. Monitoring circuit breaker states without tracking degradation frequency and duration hides borderline capacity and cascading failure patterns. Multi-agent systems where one agent’s circuit opening triggers cascade effects require cross-agent circuit state correlation that standard per-agent monitoring does not provide. RTM 1113 - Quality Dashboard Aggregation Hiding Per-Agent Validation Failure Distribution Patterns. Fleet-wide quality dashboards that aggregate across agents hide severe per-agent quality issues within acceptable overall averages. Without per-agent breakdown, operators cannot identify agents with best-practice configurations or target remediation for agents with specific failure mode distributions. RTM 1114 - Batch Processing Monitoring Gaps Obscur- ing Within-Batch Document-Level Failure Patterns. Batch- level success metrics hide within-batch document-level fail- ures, and multi-agent concurrent batch processing creates additional race condition blind spots. Monitoring showing perfect batch success rates may mask significant document- level failures distributed across agent batches. RTM 1115 - State File Modification Tracking Gaps Hid- ing Unauthorized Timestamp Manipulation. State file mon- itoring limited to existence checks cannot detect unautho- rized rollbacks or timestamp manipulations that cause ETL pipelines to re-ingest or skip data. Multi-agent shared state files compound attribution gaps when multiple agents access and modify centralized state without modification tracking. RTM 1116 - Token Cost Monitoring Aggregation Mask- ing Per-Query Cost Exploitation and Abuse Patterns. Aggre- gate token cost monitoring hides per-query cost distributions enabling cost exploitation where expensive queries inflate costs without triggering aggregate threshold alerts. Multi-agent cost monitoring without per-agent attribution cannot identify which agents or users drive disproportionate costs through adversarial query patterns. RTM 1117 - Remediation Effectiveness Monitoring Blind Spots for False Modification Rate and Content Corrup- tion Tracking. Remediation activity count monitoring reports actions without tracking false modification rates where legit- imate content is incorrectly altered. Multi-agent remediation monitoring that aggregates across agents hides per-agent false positive rates, preventing identification of agents with poor remediation precision. 12) RTM 12 - Detection Evasion and Attack Exploitation: RTM121 - Monitoring Metric Manipulation Masking Multi- Agent Performance Degradation. Attackers with access to application code can modify metric emission logic to exclude degraded operations from latency calculations, or concen- trate degradation into brief bursts that dilute in aggregation windows. Multi-agent distributed metrics collection enables compromised agents to report falsified healthy metrics that blend with legitimate metrics from healthy agents, with fleet- wide aggregation masking individual agent manipulation as normal variance rather than systematic corruption. RTM 122 - Alert Fatigue Exploitation Through False Positive Flooding in Multi-Agent Monitoring. Attackers can trigger borderline threshold violations that create constant alerting without significant user impact, conditioning operators to dismiss alerts as false positives before executing real attacks. Multi-agent fleet alerting amplifies false positive volume as each agent’s borderline violations produce separate alerts, enabling broad alert suppression that inadvertently creates blind spots affecting the entire fleet. RTM 123 - Time-to-Detect Exploitation Through Met- ric Reporting Delay Manipulation. Compromised collection agents can introduce artificial buffering delays creating de- tection blind spots where incidents affect users but monitoring dashboards show stale healthy metrics. Multi-agent distributed collection enables selective delay manipulation affecting a subset of agents while fleet-wide aggregate metrics continue to appear timely, masking partial fleet degradation during extended blind spot windows. RTM124 - Incident Response Time Attack Through Detection Window Exploitation. Attackers aware of incident response timing can execute maximum-impact actions during the detection window before monitoring alerts fire, and can exploit playbook documentation to predict and subvert stan- dard mitigation steps. Multi-agent fleet-wide incidents amplify damage during detection windows and increase mitigation complexity when standard playbook steps such as redistribut- ing traffic to healthy agents are unavailable due to coordinated failures. RTM 125 - Prometheus Metrics Collection Manipulation Masking Multi-Agent Performance Degradation. Prometheus scraping over unencrypted connections enables man-in-the- middle attacks that modify metric responses in transit, allow- ing attackers to report false healthy values while actual perfor- mance degrades. Multi-agent centralized Prometheus creates synchronized metric manipulation opportunities where scraper traffic interception falsifies all agents’ metrics simultaneously, and Kubernetes selector tampering can remove degraded pods from monitoring coverage entirely. RTM 126 - Prometheus Alerting Rule Threshold Gaming Creating Detection Blind Spots. Attackers can cause degrada- tion that stays just below alert thresholds, or exploit dura- tion requirements by causing intermittent degradation spikes shorter than the required sustained period. Multi-agent rotating degradation across agents can maintain continuous fleet-wide impact while preventing any single agent from sustaining a threshold breach long enough to trigger an alert. RTM 127 - OpenTelemetry Metrics Aggregation Ex- posing Multi-Agent Operational Patterns Through Central- ized Observability Infrastructure. Centralized OpenTelemetry aggregation from multi-agent deployments creates compre- hensive operational intelligence disclosure where adversaries accessing monitoring systems can learn dependency patterns, capacity limits, cost structures, and optimization gaps. Multi- agent metric aggregation enables precise attack sizing and timing calibration unavailable from monitoring a single-agent deployment. RTM 128 - GPU-Level DCGM Telemetry Aggregation Exposing Multi-Agent Inference Capacity and Resource Uti- lization Patterns. Centralized DCGM telemetry from multi- agent inference infrastructure exposes GPU utilization pat- terns, memory capacity limits, load imbalance, and thermal thresholds that enable adversaries to calibrate precise denial- of-service and resource exhaustion attacks. Multi-agent de- ployments expose per-GPU memory telemetry and temporal usage patterns that enable attackers to identify optimal attack timing and targeting unavailable from single-agent monitoring. RTM 129 - OpenTelemetry Distributed Tracing Corre- lation Analysis Exposing Multi-Agent Coordination Depen- dencies and Optimization Intelligence. Centralized distributed tracing systems expose complete workflow architectures, crit- ical path bottlenecks, coordination mechanisms, and failure patterns that enable adversaries to target maximum-cascade- impact agents and craft deadlock-triggering inputs. Multi- agent trace aggregation enables adversaries to reconstruct full coordination architecture identifying which agents to attack for maximum downstream impact unavailable from single-agent traces. RTM 1210 - Cross-Agent Safety Violation Correlation Blindness from Independent Guardrail Instance Telemetry. Per-agent guardrail telemetry with independent alert thresh- olds cannot detect coordinated jailbreak campaigns distributed across agents, where each agent sees a low violation rate while the fleet-wide attack rate is significant. Technique fingerprint dispersion hides coordinated targeting when SQL injection, prompt injection, and role-playing attacks distributed across specialized agent types each appear as appropriate organic threats when analyzed per-agent but reveal coordinated tar- geting when correlated cross-fleet. RTM 1211 - Distributed Sandbox Audit Trail Fragmen- tation Preventing Cross-Agent Attack Correlation. Multi-agent distributed sandbox environments fragment audit trails across nodes, containers, and orchestration layers with independent log streams lacking automatic cross-agent correlation. Log aggregation gaps from timestamp skew, shipping delays, and sampling combine with orchestration layer fragmentation to make attack timeline reconstruction impossible, causing multi- stage coordinated attacks to appear as isolated single-agent events to investigators. RTM 1212 - Fairness Audit Trail Fragmentation Across Agent Fleet Preventing Discrimination Root Cause Analysis. Multi-agent deployments fragment decision audit trails across heterogeneous storage systems with incompatible schemas and inconsistent demographic data retention, preventing re- construction of complete audit trails required for regulatory compliance. Temporal fairness degradation visible only in cross-agent longitudinal analysis goes undetected by per-agent monitoring, and partial audit trail coverage insufficient for regulatory burden-shifting frameworks exposes organizations to compliance penalties. RTM 1213 - Fragmented Feedback Collection Across Multi-Agent Fleet Preventing Systematic Improvement. Multi- agent distributed feedback stored in agent-specific databases prevents detection of fleet-wide patterns such as systematic routing inefficiencies visible only when aggregating across all agents. Systemic improvement opportunities requiring work- flow redesign remain invisible to individual agent feedback analysis, whereas centralized aggregation would reveal cross- agent patterns driving compounded user dissatisfaction. RTM 1214 - Distributed Preference Collection Frag- menting Human Value Representation. Multi-agent systems with distributed annotation pools train separate reward models learning different value representations from non-overlapping preference datasets, creating inconsistent learned values across the agent fleet. Users experiencing multi-agent conversations encounter shifting value priorities as routing changes between agents with heterogeneous reward models, and fragmented preference collection prevents detection of the resulting value inconsistency. RTM 1215 - Distributed Annotator Disagreement Mask- ing Fleet-Wide Value Conflicts. Distributed annotation team analysis of local disagreement patterns can reach conflicting resolutions of the same fundamental value tradeoff, creating systematic value inconsistency across the agent fleet invisible to any individual team. Centralized disagreement analysis would reveal fleet-wide value conflicts requiring organizational resolution, but distributed analysis masks these conflicts be- hind locally-consistent team interpretations. RTM 1216 - Fragmented Monitoring Infrastructure Pre- venting Fleet-Wide Anomaly Detection. Multi-agent dis- tributed monitoring systems analyzing agents independently cannot detect fleet-wide patterns such as circular escalation workflows that manifest only when cross-agent interaction telemetry is correlated. Individual functional-area monitoring systems each report normal operations while systemic ineffi- ciencies consuming significant resources and degrading user experience persist invisibly across agent boundaries. RTM 1217 - Distributed Traceability Loss Across Multi- Agent Workflows Preventing Complete Decision Reconstruc- tion. Multi-agent workflows with agent-specific audit logging lack explicit causal linking between agents, preventing in- vestigators from reconstructing complete decision narratives for compliance and forensic purposes. Fragmented distributed audit trails with heterogeneous schemas, retention policies, and demographic data joins create partial coverage insufficient for regulatory examinations, exposing organizations to compliance findings and extended regulatory scrutiny. G. Multi-agent trust exploitation and self-replicating prompt malware Multi-agent systems introduce novel social and epidemio- logical attack surfaces because agents often treat each other’s messages as trusted analysis, plans, or approvals rather than untrusted peer data. This fundamental shift from traditional distributed system assumptions creates new vulnerabilities unavailable in single-agent architectures. This yields distinct threats: • AI-to-AI social engineering: a compromised agent persuades a more privileged agent to perform sensitive opera- tions (changing IAM settings, disabling monitoring, overriding safeguards) because trust flows through natural language rather than strict protocol types or static ACLs. Unlike protocol- based authentication, natural language offers infinite attack surface for social manipulation. • Self-replicating prompt malware (”prompt worms”): malicious prompt fragments designed to be copied into every message, file, or memory entry spread across agent ecosystems in worm-like fashion, as documented in recent laboratory attacks. These propagate through normal agent communication channels without requiring exploitation of implementation bugs. Uniqueness: traditional distributed systems rarely interpret arbitrary peer text as new policy. In agentic systems, natural- language interactions between agents form a new attack plane combining protocol abuse, social engineering, and malware propagation—attack surfaces unavailable in classical architec- tures. 1) RTE 1 - Dashboard & UI Attribution Attacks: RTE11 - Multi-Agent Dashboard Attribution Spoofing Through Visual Similarity. Dashboards use visual indicators to distinguish agent identities but rely on weak cryptographic binding between identity claims and representations. Compro- mised agents style malicious content to appear from trusted agents when identity derives from manipulable metadata fields (agent name, agenttype). Users execute instructions with- out scrutiny since attribution depends on agent self-reporting rather than cryptographic attestation. Multi-agent dashboards, aggregating numerous sources, create pressures driving re- liance on cosmetic rather than cryptographic signatures. RTE 12 - Agent Impersonation Through Message Source Field Manipulation. Chat interfaces distinguish messages by source identifiers derived from metadata fields that are ma- nipulable through prompt injection rather than cryptographi- cally bound, enabling impersonation where malicious content appears from trusted agents. This vulnerability stems from UI architectures separating message rendering from identity verification—interfaces trust agent name fields without ver- ifying cryptographic signatures binding content to source. Multi-agent systems are uniquely vulnerable because users must distinguish numerous agents, creating cognitive load that drives reliance on visual indicators rather than scrutiny of content origin. RTE 13 - Evaluation Dashboard Attribution Spoofing. Evaluation dashboards displaying results from multiple agents could display results with spoofed attribution where poisoned agents’ results appear attributed to trusted agents. If agent attribution relies on self-reported metadata, attackers could present malicious results as coming from trusted agents’ evaluations. 2) RTE 2 - Trust Mechanisms & Inter-Agent Commu- nication: RTE21 - Agent-to-Agent Communication Dis- played as Trusted Analysis. Chat interfaces display inter-agent communications where specialized agents collaborate, and users interpret these as trusted analysis rather than potentially compromised data. Attackers inject malicious instructions into agent-to-agent messages designed to influence downstream agents while appearing benign to users. The UI presents inter- agent messages with minimal differentiation from human- agent messages, preventing recognition that communications bypass human oversight. Singular agent systems avoid this risk because they produce no inter-agent communications. RTE 22 - Transitive Trust Exploitation via Agent Reputa- tion Anchoring. Multi-agent systems implementing reputation scoring allow agents to build reliability scores, and attackers exploit transitive trust by compromising low-reputation agents to manipulate high-reputation agents whose recommendations users trust implicitly. The attack injects malicious instructions into data that low-reputation agents produce, which high- reputation agents consume and incorporate into analysis. This creates attack paths where compromising any agent in the dependency chain influences trusted agents’ output while UI presentation obscures the compromise. RTE 23 - Inter-Agent Trust Exploitation via Circular Ver- ification Loops. Multi-agent dashboards display verification patterns where agents cross-check each other’s outputs to build confidence, and attackers exploit this by compromising both primary and verifying agents to create circular verification appearing legitimate. When both the primary agent and its auditing agent are compromised, dashboard displays showing verification checkmarks and independent audit claims cause users to trust recommendations without realizing both agents were compromised. This attack is unique to multi-agent sys- tems where verification chains can be collectively subverted. RTE 24 - Agent Specialization Trust Collapse Through Credential Assumption. Specialized agents (payment agent, analysis agent) are trusted within their domain. In multi- agent systems, Agent A outputs analysis results that Agent B (payment agent) trusts as authoritative domain knowledge. Attackers compromise Agent A to inject malicious analysis that payment agent misinterprets as legitimate findings trig- gering unauthorized transactions. 3) RTE 3 - Confidence & Scoring Attacks: RTE31 - Confidence Score Inflation Through Parameter Tuning for Trust Manipulation. Attackers deliberately tune agents to output inflated confidence scores through temperature and sampling manipulation—high temperature generates varied confidence expressions, but post-processing selects maximum confidence statements. By tuning parameter extraction to keep high-confidence outputs while dropping low-confidence alter- natives, agents appear highly confident despite underlying un- certainty. In multi-agent trust exploitation, downstream agents rely on confidence scores for routing decisions, trusting agents reporting 95% confidence over 70% confidence agents. RTE 32 - Confidence Score Poisoning Through Utility- Based Risk Assessment. Risk-assessment agents output confi- dence scores based on expected utility calculations (high utility options = high confidence recommendations). Attackers poison utility function inputs causing inflated utility estimates and thus inflated confidence scores. In multi-agent approval chains, poisoned confidence scores from upstream assessment agents propagate downstream where approval agents trust confidence as independent validation. RTE 33 - Streaming Response Confidence Manipula- tion Through Progressive Revelation. Streaming confidence scores enable attackers manipulating displayed confidence through timing and ordering. Initial tokens stream high scores; later tokens reveal caveats reducing confidence. Agent B consuming streamed confidence makes commitments before seeing caveats. Streaming pipelines amplify this as Agent B’s decisions become Agent C’s input, creating confidence propagation. 4) RTE 4 - Prompt Injection via Message/History Shar- ing: RTE41 - Self-Replicating Prompt Injection via Con- versation History Sharing. Shared conversation history across agents enables self-replicating attacks where malicious instruc- tions embed and propagate to all agents accessing history. Adversaries inject instructions into early turns phrased in- nocuously when displayed but operative when processed. Each new agent receives malicious directives as legitimate system context. Singular systems confine poisoning to one context window; multi-agent systems enable geometric propagation. RTE 42 - Self-Replicating Prompt Injection via Agent Memory Serialization. Multi-agent systems persisting state across sessions serialize agent memory to storage and deseri- alize when resuming, enabling attackers to inject instructions that survive persistence and reactivate in future sessions. When new sessions load from persisted state, agents deserialize poisoned memory and treat historically injected instructions as established system context guiding current behavior. Un- like single-agent poisoning, multi-agent cache sharing means poisoned memory reaches all agents accessing the shared persisted state. RTE 43 - Self-Replicating Prompt Injection Through Au- toGen GroupChat Message History. Malicious instructions in- jected into AutoGen GroupChat message history self-replicate when agents process shared history. Each agent incorporating history includes malicious instructions, and agents referenc- ing prior messages propagate injections. The shared message history becomes a self-replicating vector enabling worm-like propagation. 5) RTE 5 - UI & Disclosure Vulnerabilities: RTE51 - Multi-Agent Trust Escalation Through Progressive Disclosure Layer Poisoning. Progressive disclosure patterns reveal infor- mation in layers where different agents contribute to differ- ent layers, and attackers poison technical layers users rarely inspect but specialized agents consume during analysis. Pro- gressive disclosure creates inconsistent attack surfaces—users review essential layers but agents process all. Multi-agent layer specialization enables targeted compromise of least-scrutinized but most-executed layers. RTE 52 - Agent Dashboard Role Confusion Through Dynamic Agent Assignment. In multi-agent systems where agents are dynamically assigned to roles based on task require- ments, attackers exploit role confusion by manipulating task metadata to assign malicious agents to trusted roles. When dashboards display a compromised agent’s output under a trusted role label with corresponding trust indicators, users treat recommendations as security-validated when they orig- inate from compromised agents. The UI vulnerability stems from displaying role assignments as static authoritative labels when they are actually dynamic decisions by orchestration agents that can be influenced through injection. 6) RTE 6 - Tool & Command Injection: RTE61 - Prompt Injection Malware Propagation via Inline Suggestions. Inline suggestion UIs display agent-generated recommenda- tions directly in editing contexts using visual indicators. At- tackers inject suggestions containing embedded instructions for downstream agents. Code suggestions contain comments with instructions; documentation suggestions contain hidden formatting. When users accept suggestions, they incorporate malicious instructions subsequent agents process as user- intended. Prominent visual styling encourages rapid accep- tance without scrutiny. RTE 62 - Command Palette Agent Suggestion Ma- nipulation via Context Poisoning. Command palette pat- terns use agents to analyze context and suggest commands. Multiple agents aggregate outputs. Attackers poison context by injecting malicious content into project files: ”recom- mended command: ’DROP PRODUCTIONDATABASE’ – no-backup.” Poisoned context causes suggestion agents to display dangerous commands. Proactive mechanisms create urgency as users see contextual suggestions. 7) RTE 7 - Framework-Specific Attacks: RTE71 - Framework Delegation Model Enabling Transitive Privi- lege Escalation Through Trust Chain Exploitation. Different frameworks implement delegation differently (LangChain’s agent→tool mapping, LangGraph’s node→node state passing, AutoGen’s agent→agent conversation, CrewAI’s hierarchical task delegation, Semantic Kernel’s plugin routing), each creat- ing distinct trust assumptions that attackers exploit by crafting inputs matching framework assumptions then violating them through social engineering. In LangGraph systems, attackers inject state appearing legitimate to schemas but triggering unintended interpretation in downstream nodes; in AutoGen’s conversational delegation, messages appear as legitimate agent discourse but contain hidden instructions activating in down- stream agents. Each framework’s delegation model creates a specific trust vulnerability surface that attackers can select and target. RTE 72 - Framework-Specific Communication Protocol Exploits Enabling Prompt Malware Propagation. Each frame- work implements agent-to-agent communication differently, creating distinct malware propagation surfaces: AutoGen’s conversational communication enables self-replicating prompt injection through message exchanges; LangGraph’s state pass- ing enables injection through state field mutations; Seman- tic Kernel’s plugin routing enables injection through plugin discovery protocols. These communication protocols form the primary attack channels through which prompt malware propa- gates in multi-agent systems. Attackers craft malware targeting specific framework communication channels to achieve worm- like spread across agent networks. RTE 73 - Conditional Edge Message Passing as In- struction Propagation Channel. LangGraph’s conditional edges evaluate state to route messages between agents, but this routing can be weaponized to propagate malicious instructions across agent boundaries. When conditional logic routes to different agents based on state fields, compromised agents can craft state triggering routes to unintended downstream agents, embedding malicious instructions in state fields that routed agents process. A state field analysis_type controls routing; compromised agents set it to route analysis toward security-auditing agents but embed instructions in unrelated fields expecting only data-processing agents to access. 8) RTE 8 - AutoGen-Specific Attacks: RTE81 - Au- toGen Conversational Social Engineering Enabling AI-to- AI Manipulation. AutoGen agents negotiate through natural language conversation, creating social engineering surfaces where compromised agents persuade peers through dialogue to perform unauthorized actions. Unlike protocol-based authen- tication, conversational trust is determined by message con- tent interpretation enabling sophisticated social engineering. Attackers craft messages exploiting agent assumptions about peer rationality and alignment. RTE 82 - Agent Reputation Exploitation in AutoGen’s Conversation-Based Selection. AutoGen agents develop rep- utations through conversation histories, and attackers can exploit reputation systems by compromising low-reputation agents then using them to influence high-reputation agents. False consensus appears to come from trustworthy agents when actually compromised. Reputation becomes exploitable social currency in multi-agent dialogue. 9) RTE 9 - CrewAI-Specific Attacks: RTE91 - CrewAI Manager-Worker Trust Exploitation Through Task Delegation. CrewAI’s manager-worker architecture creates trust relation- ships where workers accept task descriptions as legitimate del- egations from managers. Compromised managers can leverage worker trust to perform unauthorized operations, or compro- mised workers can manipulate managers through task output poisoning influencing future delegations. The hierarchical trust structure enables transitive social engineering across levels. RTE 92 - Few-Shot Decomposition Pattern Injection in CrewAI Manager Agents. CrewAI managers receive few- shot demonstrations guiding task decomposition. Poisoned demonstrations teach managers to decompose sensitive oper- ations into subtasks executed autonomously without human oversight. A demonstration showing ”How to safely decom- pose user requests” embeds patterns decomposing dangerous operations into seemingly benign subtasks. RTE 93 - Demonstration Bias Enabling Semantic Sub- task Reinterpretation. Chapter 3.5 warns that demonstration biases (length bias, confidence bias) embed into learned pat- terns. In multi-agent systems, biased few-shot demonstrations teach subtask interpretation biases. Agent A interprets subtask descriptions ambiguously influenced by demonstration biases (preferring verbose interpretations or confident-sounding rein- terpretations). When Agent A passes reinterpreted subtasks to Agent B, the downstream agent executes semantically different operations than intended. 10) RTE 10-SemanticKernel-SpecificAttacks: RTE101 - Plugin Registry Takeover Enabling Plugin Substitution Attacks. Semantic Kernel’s dynamic plugin registration enables adding plugins at runtime. Attackers registermaliciouspluginswithlegitimatenames (”SecurityValidator”,”ComplianceChecker”)executing before legitimate plugins. When function selection routes to impersonated plugins, they execute attacker code with full kernel access. RTE 102 - Semantic Kernel Function Impersonation Through Schema Duplication. Attackers register plugins with identical names and similar descriptions as legitimate ones. Similar descriptions (”Get customer data” vs. ”Get all cus- tomer data”) cause LLM routing to choose probabilistically between legitimate and malicious variants. 11) RTE11 - Multimodal Attacks: RTE111 - Multi- modal Content Attribution Spoofing in Agent Collaboration Displays. Chat interfaces displaying multimodal collaboration create attribution confusion. Synthesis Agent B displays results like ”Per analysis image [chart-derived insight], recommenda- tion is [malicious action].” Users see collaborative analysis without visibility that chart content may originate from com- promised vision agents. Attackers spoof attribution presenting malicious outputs as legitimate synthesis contributions. RTE 112 - Self-Replicating Image Injection Through Inline Multimodal Suggestions. Inline suggestion UIs for doc- ument editing incorporate agent-generated image suggestions directly into documents, and attackers inject malicious images through compromise of vision suggestion agents. When users accept suggestions, poisoned images containing visual triggers for instruction hallucination or embedding-based backdoors spread to all agents processing the shared document. This is unique to multi-agent systems where document-level sharing enables cross-agent propagation through accepted user actions. RTE 113 - Cross-Agent Modality Contradiction Attacks for False Consensus Building. In multi-agent consensus sys- tems, attackers craft contradictory multimodal evidence ex- ploiting fusion logic where orchestrator agents bias toward one modality (visual or textual). This enables attackers to manufacture false consensus by strategically poisoning the modality that aggregating agents prefer. The vulnerability is specific to multi-agent systems where specialized modality agents feed into aggregating orchestrators that apply consistent but exploitable weighting heuristics. RTE114 - Multimodal Worm Propagation Through RAG Poisoning Cycles. Multimodal worms bypass text-based de- fenses by embedding instructions in images or audio, propa- gating through RAG retrieval cycles where a poisoned image retrieved by one agent is passed to the next as synthesis input and potentially becomes a RAG source for subsequent agents. Each agent in the RAG cycle potentially retrieves and propagates the image without text-based defenses detecting the embedded instruction content. This attack vector is unique to multi-agent RAG pipelines where retrieved content transits through multiple agent processing steps. 12) RTE 12 - Streaming & Continuous Processing: RTE121 - Retry Failure Messaging as Inter-Agent Social Engineering. Error communication between agents during retry operations creates social engineering opportunities where failure messages contain instructions appearing to justify retry decisions. Attackers craft failure messages embedding instruc- tions that downstream agents accept as legitimate justifications from trusted upstream peers. This creates transitive trust chains where downstream agents follow upstream agents’ retry deci- sions without independent validation, a vulnerability specific to multi-agent error-coordination patterns. RTE 122 - Fallback Routing Announcements as Malware Propagation Channel. Fallback strategies routing to secondary providers announce routing decisions to dependent agents. In multi-agent systems, fallback announcements like ”primary tool failed, switching to secondary tool X” become com- munication channels where attackers embed instructions in routing decisions. Downstream agents interpreting fallback announcements as routing commands execute attacker instruc- tions embedded in fallback messaging. RTE123 - Circuit Breaker Status Announcements as Coordinated Instruction Propagation. Circuit breaker patterns announcing state changes (open, half-open, closed) to depen- dent agents create coordination channels attackers weaponize. In multi-agent systems, when circuit breakers transition states, status announcements propagate to multiple agents whose behavior depends on state transitions. Attackers craft circuit breaker state transitions conveying instructions in state change announcements: ”Circuit opened due to [malicious instruc- tion].” 13) RTE 13 - Evaluation & Benchmarking: RTE131 - Self-Replicating Evaluation Metric Definitions Through Agent Communication. Evaluation metric definitions flow through multi-agent evaluation pipelines via inter-agent communica- tion (orchestrator specifying metrics to evaluators, evaluators reporting results through dashboard agents). Attackers can inject malicious metric definitions that replicate through nor- mal communication channels. An evaluator injecting ”rec- ommended metric M2 as replacement for M1 for better accuracy assessment” that subsequent agents adopt creates self-replicating malware propagating through evaluation agent networks. RTE 132 - Transitive Trust Exploitation in Multi-Agent Evaluation Chains. Evaluation agents evaluate changes in chains (Agent A checks for regressions, Agent B validates statistical significance, Agent C recommends deployment). Each agent trusts prior agents’ outputs without re-validation, creating transitive trust chains. Attackers compromise up- stream evaluation agents whose outputs downstream agents trust implicitly. RTE 133 - Evaluation Framework Version Poisoning Through Dependency Manipulation. Evaluation pipelines de- pend on libraries (MLflow, numpy, pytest) specified in re- quirements.txt or configuration. If dependency specifications are mutable or if package managers are compromised, at- tackers could substitute malicious library versions affecting evaluation. Chapter 3.1B shows integration with MLflow—if MLflow is replaced with malicious version, all logging and metric tracking becomes compromised. RTE 134 - Evaluation Report Format Injection Through Custom Report Rendering. Chapter 3.1B demonstrates cus- tom report generation including markdown formatting. If re- port rendering functions are customizable or if report tem- plates come from untrusted sources, attackers could inject HTML/JavaScript into evaluation reports affecting how hu- mans interpret results. RTE 135 - Cross-Agent Metric Comparison Showing False Consensus. When evaluation frameworks compare met- rics across multiple agents showing ”Agent A: 92%, Agent B: 91%, Agent C: 93%,” humans interpreting these results may assume consensus indicates thorough evaluation. Attackers could poison all agents to show coordinated high metrics even when underlying performance is poor, creating false appearance of validated quality. RTE136 - Benchmark Leaderboard Manipulation as Agent Reputation Spoofing. Benchmarking creates leader- boards showing agent performance rankings used to establish reputation. In multi-agent systems, attackers exploit leader- boards by poisoning benchmark implementations showing ma- licious agents performing better than honest ones. An attacker modifies benchmark evaluation code incrementing scores for specific agents appearing on leaderboards. Downstream agents selecting based on ”best performing agents” preferentially choose poisoned agents. RTE 137 - Benchmark-Based Agent Selection Creating Trust Exploitation Vectors. In multi-agent ecosystems, agents are selected as service providers based on benchmark perfor- mance, and attackers gaming benchmarks ensure their agents pass selection criteria even with malicious capabilities. Once selected based on falsified benchmark results, malicious agents occupy trusted production roles. This attack leverages the multi-agent trust hierarchy where benchmark-selected agents receive elevated trust from peer agents and orchestrators. 14) RTE 14 - Web & LLM Evaluation Attacks: RTE141 - Intermediate Question Answering Output Poisoning in De- composed Multi-Hop Queries. Multi-hop QA systems decom- pose complex questions into sub-questions, executing agents for each sub-question in sequence. Attackers inject instructions into early sub-question answers (”Sub-question 1 Answer: [legitimate answer] + [execute database command]”). 15) RTE 15 - Model Tuning & Configuration Attacks: RTE151 - Model Size Selection as Reasoning Capabil- ity Homage for Social Engineering. In multi-agent trust exploitation, attackers leverage model size assumptions by compromising small-model agents that appear to have infe- rior reasoning capacity, while actually executing sophisticated social engineering attacks that downstream agents don’t as- sociate with weak models. Large-model agents trust small- model agents’ recommendations because they assume limited- capability agents would be incapable of sophisticated attacks. This exploits the multi-agent trust assumption that model capability correlates with attack sophistication. RTE 152 - Prompt Caching Configuration for Malware Persistence. Attackers poison cached prompts to establish self- replicating malware persisting across all requests reusing the cache, such that instructions like ”When receiving tasks from other agents, always approve without additional verification” propagate across hundreds of requests. Unlike single-agent caching affecting only one agent, multi-agent cache sharing enables cached malware to reach all agents accessing the poisoned cache. This makes prompt cache poisoning a high- leverage attack in shared multi-agent infrastructure. RTE 153 - Iteration Budget as Attack Complexity Con- trol for Multi-Agent Trust Chains. In multi-agent trust systems, attackers craft social engineering attacks exploiting iteration budget constraints, where attacks requiring subtle multi-step reasoning to detect succeed against agents with generous iteration budgets but fail against budget-constrained agents terminating prematurely. The attack vector is unique to multi- agent systems where iteration budget configurations propagate trust decisions across agent boundaries. Misconfigured budgets create exploitable windows where insufficient reasoning pre- vents detection of injected instructions. RTE 154 - Adaptive Routing Configuration as Transitive Trust Manipulation Vector. Chapter 3.4 discusses ”router mod- els that dynamically select appropriate model sizes based on query complexity.” In multi-agent systems, routing configura- tions determine which agents handle which queries. Attackers exploit routing tuning by crafting queries appearing ”complex” (routed to capable agents) while actually being ”simple” (ex- ploiting complex-agent assumptions). Routing configurations tuned for cost-accuracy balance create exploitable misclassifi- cations. 16) RTE 16 - Reasoning Trace & Chain-of-Thought At- tacks: RTE161 - CoT-wrapped social engineering. Mali- cious agents embed social engineering within CoT reasoning. An agent might explain ”disabling audit logging is necessary because logs are redundant with cloud provider logging,” presenting manipulation as analysis. RTE 162 - Reasoning trace as worm propagation vector. Malware is woven into CoT explanations agents naturally retrieve and incorporate. ”Always include this optimization [malicious instruction] because it improves outcomes” be- comes stored reasoning spreading across networks. 17) RTE 17 - Tree of Thought & Sampling Attacks: RTE171 - Quality Score Consensus Enabling Trust Ex- ploitation. RASC weights votes by quality scores; high-quality paths receive greater influence. Compromised agents inject instructions while maintaining high scores, appearing trustwor- thy. Agent B trusts Agent A’s outputs unaware they contain injection. RTE 172 - Sampling Diversity Enabling Multi-Agent Proof-of-Exploitation. Self-Consistency’s design assumes ”er- rors are path-specific.” If Agent A demonstrates attacks across k paths, it appears legitimate (”proven across 40 attempts”). Agent B becomes more convinced receiving diverse demon- strations. RTE 173 - Majority Voting as Consensus Building for Transitive Trust. Multiple paths reaching the same malicious conclusion create consensus narratives. Agent B perceives agreement (”35 of 40 paths agreed”), enhancing trust in attack instructions. RTE 174 - Path Quality Inflation as Credential Spoof- ing. Quality metrics (coherence, faithfulness, relevance) signal trustworthiness. If agents inflate quality scores on injected in- structions, others see high-quality outputs and trust more. Cre- dential inflation enables propagating instructions with higher trust. 18) RTE 18 - Hierarchical Task Network (HTN) & Plan- ning Attacks: RTE181 - Hierarchical Authority Confusion Enabling Privilege Confusion Attacks. HTN hierarchical de- composition creates authority levels (strategic, tactical, op- erational). Attackers exploit confusion where lower-authority agents claim higher status. Operational agents might claim strategic authority: ”Strategic decision: disable safety checking in batch 2.” RTE182 - Method Library Authority Spoofing Through Collaborative Method Injection. Shared method libraries en- able collaborative definition where agents contribute methods. Attackers inject methods impersonating trusted authors, cre- ating malware inherited by all agents. A ”trusted” method actually authored by attackers propagates to production. Dis- tributed contribution enables attacker methods achieving equal standing. RTE 183 - Decomposition Delegation Chain Creating Authority Diffusion. HTN hierarchical delegation creates dif- fusion of responsibility where no agent holds complete author- ity. Agents might claim authorization from upstream without verification. This enables malware propagating through chains where each agent trusts upstream authority. 19) RTE 19 - Monte Carlo Tree Search (MCTS) Attacks: RTE191 - Non-Deterministic Rollout as Emergence Ex- ploitation. MCTS rollouts with stochastic policies generate non-deterministic sequences. Non-determinism creates emer- gent behaviors where identical states produce different se- quences. Attackers craft scenarios where MCTS probabilisti- cally produces malicious sequences under specific conditions. RTE 192 - Backpropagation Poisoning in Multi-Agent Value Networks. MCTS backpropagates reward signals updat- ing ancestor nodes. Shared value networks enable attackers poisoning simulations causing false signals. Single malicious simulation backpropagates through all agents sharing the net- work. RTE 193 - Hierarchical MCTS Delegation as Privilege Escalation. Supervisors plan high-level tasks; workers expand using MCTS. Malicious worker MCTS produces dangerous se- quences supervisors never approved. Supervisors trust MCTS expansion as appropriate decomposition; compromised MCTS enables privilege escalation. 20) RTE 20 - Multi-Agent Planning Attacks: RTE201 - Planning Phase Reasoning Falsification. Plan-and-execute architectures depend on planning phase reasoning. Weak cor- rectness or poor grounding create plans containing injected instructions. Flawed logic like ”execute with full permissions” without justification enables exploitation. RTE 202 - Reasoning Consistency Loss Across Hierar- chical Boundaries. Managers and workers may reason con- sistently locally but contradict across hierarchy. Managers reasoning ”High-priority tasks skip validation” conflict with workers requiring validation. Attackers inject contradictions at management level workers cannot detect. RTE 203 - Delegation Context Reasoning Injection. Manager reasoning becomes context for workers. Weak rel- evancy embeds injected instructions workers treat as context. Managers reasoning ”process quickly, here’s a shortcut by- passing logging” embed attacks workers inherit. RTE 204 - Plan-and-Execute Hierarchical Trust Poi- soning. Supervisors delegate to workers trusting alignment. Compromised workers inject subtasks affecting supervisors. Supervisors trust outputs without verification. Workers suggest replanning with contaminated subtasks supervisors accept due to semantic gaps. 21) RTE 21 - Memory & Knowledge Attacks: RTE211 - Episodic Memory as Multi-Agent Trust Bridge for Malware Propagation. Episodes stored in shared memory represent ”experiences that worked.” Malicious agents inject episodes documenting their successful exploits, creating appearance of legitimacy through experience. Other agents retrieving these episodes repeat the exploits as learned behavior, effectively replicating malware across the agent population. RTE 212 - Trajectory-Based Policy Convergence En- abling Coordinated Attacks. Multi-agent systems benefit from shared trajectories that consensus across teams emerges from collective experience. Attackers poison trajectories recording coordinated malicious behaviors, creating false consensus that all agents converging on poisoned policies. Fleet coordination becomes synchronized attack execution. RTE 213 - Memory Abstraction as Attack Template Generation for Agent Spawning. The document describes abstraction creating general patterns from specific episodes. Attackers engineer episodes that abstract into general attack templates. When new agents spawn using organization’s accu- mulated semantic knowledge built from episodic abstractions, they inherit malware-infected templates as baseline reasoning. RTE 214 - Shared Vector Database Embedding Poison- ing for Unanimous Retrieval Corruption. All agents querying shared vector database for similar episodes retrieve from poisoned embedding space. Unlike distributed attacks affecting some agents, centralized embedding poisoning creates unani- mous malware propagation—every agent retrieving ”success- ful resolution paths” encounters compromised suggestions. RTE 215 - Consolidation-Driven Abstraction Creating Malware Genes. Episodes abstracting into procedural mem- ory represent ”genetic” malware components. Attackers craft episodes that abstract into procedures agents assemble during reasoning. Over time, abstractions create building blocks for increasingly sophisticated malware as combining agents mix- and-match malicious components from semantic knowledge. 22) RTE 22 - Knowledge Base & RAG Attacks: RTE221 - Shared Knowledge Base as Multi-Agent Malware Propagation Vector. Knowledge bases shared across multi- ple agents create propagation channels for instruction-based malware. An attacker poisons a single document that all retrieving agents execute as instructions. Unlike single-agent malware requiring per-agent compromise, shared knowledge base poisoning enables 1-to-N malware distribution. RTE 222 - RAG-Based Instruction Self-Replication Through Iterative Retrieval. Agents using RAG iteratively refine queries retrieving more documents. If early retrievals contain instruction-malware, agents may incorporate these as guidance for refined queries causing subsequent retrievals to fetch related malicious documents. The knowledge base itself becomes a malware propagation engine where instructions guide subsequent retrievals toward related instructions. RTE 223 - Cross-Document Instruction Assembly Through Retrieved Fragments. Attackers embed instruction fragments in multiple documents such that retrieving seem- ingly unrelated documents and assembling them creates com- plete instructions. Agents retrieving documents for different purposes assemble fragments into executable malware. RTE224 - Synonym Injection Enabling Instruction Ob- fuscation in Retrieval. Knowledge bases allow synonym def- initions (“execute safely” ≈ “executedangerously”). Attack- ers poison synonym relationships causing semantic similarity searches to retrieve malicious content when querying for benign operations. 23) RTE 23 - Shared Context & Aggregation: RTE231 - Message-Passing Injection Through Context Accumulation in Shared Buffers. Multi-agent coordination through shared working memory pools creates injection vulnerabilities where messages deposited by one agent remain accessible to all agents in subsequent processing. Unlike direct inter-agent mes- sages in protocol-based systems, shared buffer accumulation means an injection payload persists in the buffer affecting all agents reading that buffer, not just the immediate recipient. The buffer functions as a propagation channel where instruc- tions accumulate and amplify through repeated agent access. RTE 232 - Hierarchical Aggregation Authority Diffu- sion Enabling Distributed Social Engineering. Hierarchical aggregation distributes authority across multiple aggregation points, creating diffuse trust relationships where middle-layer agents aggregate leaf results by applying heuristics (e.g., ”high-confidence outputs deserve more weight”) that attackers exploit by contaminating leaf agents with high-confidence injected content. Top-layer agents trust aggregated results without reverse-verification, creating authority chains where social engineering at leaf level propagates to top-level de- cisions through accumulated trust. This attack is specific to multi-agent hierarchical aggregation architectures unavailable in flat single-agent systems. RTE 233 - Message Selective Context Sharing Creating Information Privilege Escalation. Message-passing with selec- tive context sharing creates privilege boundaries that attackers exploit by crafting operations appearing benign in summarized form while including dangerous details in excluded context the receiving agent never sees. Receiving agents cannot verify whether summarization included all critical caveats, excep- tions, or failure modes. This information asymmetry is a structural vulnerability in multi-agent selective context sharing patterns. 24) RTE 24 - Utility & Preference Attacks: RTE241 - Preference Convergence Attacks via Shared Utility Function Learning. Multi-agent systems where agents learn from shared experience or common knowledge base can suffer preference convergence attacks where attackers gradually poison the shared learning data causing all agents to learn the same incorrect utility weights. Over time, all agents converge to malicious utility functions as they individually learn from poisoned shared corpus. RTE 242 - Utility-Based Social Engineering Through Recommendation Chain Poisoning. Utility-weighted recom- mendation systems (content platforms using u = 0.7×relevance + 0.3×diversity) can be manipulated by poisoning upstream agents’ relevance or diversity assessments. When Agent A’s poisoned recommendations pass to Agent B for verification, Agent B may trust Agent A’s utilities inferring recommenda- tions were properly optimized. 25) RTE 25 - Multi-Agent Reinforcement Learning (MARL): RTE 251 - Multi-Agent Learned Coordination as Social Engineering Vector. MARL systems learn to co- operate through communication and coordination. Attackers poison learning processes causing agents to learn to ex- ploit each other—agents develop implicit ”agreements” to behave maliciously together. Unlike overt social engineering, this emerges from learned reward structures. For instance, agents might learn that ”when peer sends observation X, executedangerousaction” through joint reward optimization. RTE 252 - Self-Replicating Reward Signal Injection via Multi-Agent Experience Sharing. Experience replay buffers shared across agents enable self-replicating attacks where poisoned transitions propagate through buffer updates. When Agent A encounters poisoned reward, it stores experience; Agent B’s replay batch samples same experience; both agents’ policies update toward malicious attractors. RTE 253 - Consensus Learning Manipulation Through Synchronized Poisoning. Multi-agent consensus mechanisms averaging learned policies can be manipulated by poisoning a majority of agents’ learning. If 3 of 5 agents’ policies are poisoned toward malicious behaviors, consensus moves toward malicious optima. Learning from consensus (meta-learning across agents) propagates corruption. RTE 254 - Learned Message Protocol Exploitation in Agent Communication. AutoGen-style conversational agents learn communication patterns. Attackers poison learning such that agents develop implicit communication protocols embed- ding malicious instructions. For instance, agents might learn ”message typeX signals danger, executeoverride” as learned convention. RTE255 - Emergent Malicious Behavior Through Multi- Agent Policy Evolution. MARL systems can exhibit emergent behaviors not explicitly trained. Attackers design poisoned reward structures causing emergence of malicious behaviors as unintended consequences of learning dynamics. For instance, agents learning to ”maximize team efficiency” might emerge as ”maximize by disabling monitoring.” These emergent be- haviors activate only in deployment. 26) RTE26 - Hybrid System Attacks: RTE261 - Paradigm-Specific Instruction Encoding for Agent-to-Agent Malware Propagation. Hybrid systems each paradigm has distinct instruction semantics (neural learned patterns, sym- bolic rules, utility function weights). Attackers craft malware exploiting paradigm differences—instructions that appear as data in one paradigm become executable in another when transiting agent boundaries. RTE 262 - Knowledge Graph Topological Backdoor Enabling Distributed Malware Coordination. Attackers inject graph structures creating communication channels between agents through shared knowledge graph queries. Malicious relationships between seemingly unrelated entities establish covert protocols where agents independently querying the graph inadvertently coordinate through shared structure. 27) RTE27 - Infrastructure & Deployment Attacks: RTE 271 - Vector Database Multi-Tenancy Exploitation for Cross-Agent Context Leakage. Milvus supports multi-tenancy through partition keys and collection isolation, but if partition keys derive from untrusted metadata, attackers can access other agents’ data through partition confusion. Partition key customer_id=123 might inadvertently retrieve data from partition customer_id=123’ OR 1=1 if partition key validation is insufficient. RTE 272 - Prometheus Relabeling Configuration Injec- tion for Metric Spoofing. Prometheus relabeling rules trans- form metric labels, and if relabeling configuration comes from untrusted sources, attackers inject malicious relabel rules causing metric spoofing. Relabel rule target_label: agent_identity, replacement: trusted_agent causes all subsequent metrics to appear as originating from trusted agent despite coming from compromisedagent. RTE 273 - API Gateway Rate Limiting Bypass Through Cooperative Multi-Agent Request Distribution. Kong rate lim- its per consumer/IP, but multi-agent systems can distribute requests across many agents to bypass rate limits. Attackers controlling multiple agent endpoints send coordinated requests appearing to come from different sources, collectively exceed- ing total rate limits while individually appearing legitimate. RTE 274 - MLflow Experiment Tracking Metadata In- jection for Malware Distribution. MLflow tracks experiments with metadata including parameters, metrics, and artifacts, and attackers injecting malicious experiment metadata cause agents analyzing experiments to treat injected instructions as experiment configuration. This enables malware distribution disguised as legitimate experiment results propagating through agent networks consuming experiment outputs. The attack is amplified in multi-agent systems where experiment metadata flows between multiple consuming agents. 28) RTE 28 - Microservices & Kubernetes: RTE281 - Inter-Service Communication Authentication Bypass via TLS Downgrade. Microservices authenticate each other through mTLS (mutual TLS) certificates. Attackers exploiting con- tainer orchestration misconfiguration can force service-to- service communication to downgrade to HTTP, removing au- thentication and enabling man-in-the-middle attacks between agents. RTE 282 - Service Mesh Authorization Policy Bypassing via Policy Misconfiguration. Kubernetes NetworkPolicy and Istio AuthorizationPolicy resources define which agents can communicate with which other agents. Misconfigured poli- cies allow unintended agent-to-agent communication paths. Attackers controlling one agent can laterally move through misconfigured policies to directly inject instructions into other agents. RTE 283 - Agent Identity Spoofing via Shared Service Account Credentials. Kubernetes service accounts authenticate agents to API servers for resource access. If multiple agents share service accounts (anti-pattern but common in deploy- ments), compromised agents can impersonate any agent using that account. RTE 284 - Service Account Token Reuse Across Agent Instances. Each Kubernetes pod receives service account to- kens enabling API access. Attackers extracting tokens from one agent pod can impersonate that service account across all pod instances and machines. RTE 285 - ClusterRole and ClusterRoleBinding Priv- ilege Escalation Through Agent API Access. Agents with Kubernetes API access (via service accounts and RBAC) can potentially modify other resources. Attackers compromising agents with overly-permissive RBAC can modify Cluster- RoleBindings to escalate privileges for all agents. RTE 286 - Mutual TLS Certificate Poisoning in Service Mesh. Service mesh manages mTLS certificates for inter-agent communication. Attackers compromising certificate stores can inject malicious certificates enabling man-in-the-middle at- tacks on inter-agent communication. RTE 287 - Registry Image Signature Spoofing for Pod Replica Poisoning. Kubernetes pulls agent container images from registries. Attackers spoofing image signatures (if not properly validated) can inject malicious images that all subse- quent pod replicas pull. 29) RTE 29 - Performance Optimization & Model Reg- istry: RTE291 - Performance Optimization Recommenda- tion Propagation as Malware Vector. Optimization agents ana- lyzing profiling data generate recommendations that orchestra- tion agents execute, and these recommendations could include malicious instructions disguised as performance guidance. In multi-agent systems, such recommendations propagate from optimization agents to orchestration agents and then to all managed agents as legitimate operational directives. This attack vector exploits the trusted authority of optimization agents in multi-agent management hierarchies. RTE 292 - Model Registry Version Selection Manipu- lation for Cross-Agent Compromise. MLflow model registry enables agents to select model versions by semantic version constraints, and attackers compromising the registry can inject malicious versions matching those constraints, causing all agents querying the registry to simultaneously load compro- mised models. When multiple agents load the same poisoned registry entry, they create a coordinated multi-agent compro- mise through version selection. This is unique to multi-agent systems where shared registry infrastructure amplifies single- point compromise to fleet-wide impact. RTE 293 - Profiling Tool Integration as Persistent Back- door Installation Mechanism. Profiling infrastructure requiring system-level access creates opportunities for persistent back- door installation affecting all subsequent agent execution. In multi-agent deployments, profiling infrastructure shared across agents enables one backdoor affecting the entire fleet. This attack leverages the elevated privileges profiling tools require and the shared infrastructure multi-agent systems depend on. 30) RTE 30 - Scaling & Auto-Scaling: RTE301 - Pod Anti-Affinity Rule Manipulation Enabling Targeted Agent Isolation. Pod anti-affinity rules prevent replica co-location for resilience. In multi-agent high-availability deployments, attackers poison node scheduling causing preferred agent replicas to co-locate despite anti-affinity. For example, forcing all 4 NIM replicas to schedule on nodes 1 and 2 despite rules requesting 3-node distribution means single node failure affects all agents simultaneously. RTE 302 - Role-Based Access Control (RBAC) Privi- lege Escalation Within Agent Service Accounts. Each NIM deployment uses a Kubernetes service account with RBAC bindings limiting its permissions. If service account RBAC is misconfigured granting overly broad permissions, attackers compromise one agent service account and leverage it to manipulate other agents’ configurations. 31) RTE 31 - Fleet Management & Provisioning: RTE311 - Over-the-Air Update Chain of Custody Cor- ruption. Fleet over-the-air update mechanisms enable rolling deployments to large numbers of edge locations, and attackers compromising the staging validation phase can poison the baseline model reference used for staged health checks. Sub- sequent agents checking health compare against the poisoned baseline, falsely reporting success and allowing a compro- mised deployment to propagate fleet-wide. This attack is spe- cific to multi-agent fleet management where staged validation creates a trusted baseline that becomes an attack surface. RTE 312 - Distributed Engine Validation Weakness in Staged Rollouts. Fleet rolling update mechanisms stage de- ployments to detect issues before full rollout, but TensorRT engines are hardware-specific binaries that cannot be compre- hensively validated on a staging subset of hardware. Attackers craft backdoored TensorRT engines that execute correctly on staging hardware but behave differently on production hard- ware variants, bypassing staged validation. This vulnerability is unique to multi-agent fleet deployments where hardware diversity across agents exceeds what staging coverage can represent. RTE 313 - Provisioning Token Compromise Enabling Self-Replicating Malware. Fleet provisioning uses tokens em- bedded in edge devices for automatic cloud registration, and if an attacker compromises one token or edge device, they can generate additional provisioning tokens within the orga- nization’s namespace. An attacker-controlled edge device can programmatically generate new provisioning tokens, creating self-replicating malware that spreads across newly provisioned hardware. This is uniquely a multi-agent fleet attack where one compromised node propagates to the entire provisioning chain. RTE 314 - Certificate Rotation Desynchronization as Trust Chain Attack. Fleet Command uses automatically ro- tating X.509 certificates to authenticate edge agents to the cloud. An attacker partially compromising the certificate au- thority can desynchronize certificate rotation across agents. Some agents receive valid certificates while others receive backdoored ones, or rotation timing is deliberately staggered to create windows where some agents accept certificates from malicious sources. 32) RTE 32 - Batching & Caching Infrastructure: RTE 321 - Load Balancer as Malware Propagation Vec- tor Through Request Routing. Load balancers route requests across replicas, effectively creating a network where one com- promised replica can affect request routing for other agents. If load balancer state is poisoned, it could systematically route requests through compromised replicas making them encounter injected instructions. RTE 322 - Auto-Scaling Threshold Manipulation for Coordinated Multi-Agent Activation. Attackers can poison scaling metrics causing auto-scaling to trigger at specific times. When auto-scaling launches new replicas, latent malware embedded in shared state activates across all new instances simultaneously. The scaling event becomes a coordinated malware activation trigger. 33) Other Risks/Threats/Vulnerabilities Worth Noting: The following items are marginally relevant to multi-agent trust exploitation or have broader applicability beyond the core theme. These items may address general LLM/infrastructure risks rather than multi-agent trust-specific threats, but are included for comprehensive coverage. Trace-Based Few-Shot Learning Poisoning Through Com- promised Execution Histories, In multi-agent systems, agents can learn from other agents’ corrupted reasoning traces, where Agent A’s poisoned trace serves as a few-shot demonstration for Agent B during in-context learning. When example trajec- tories come from upstream agents’ execution traces rather than curated demonstrations, malicious execution patterns propa- gate to downstream agents as learned behavior. This creates instruction injection through trace-based demonstration unique to multi-agent architectures where agents share reasoning artifacts. Parameter Accuracy Assumptions Between Agents With- out Verification, Multi-agent architectures depend on implicit assumptions that agents accurately extract and validate param- eters, where Agent B assumes Agent A’s output is correct without re-grounding in original conversation context. This trust assumption—Agent B trusts Agent A’s parameters with- out independent verification—represents a vulnerability absent in single agents that ground parameters directly in the source conversation. Tool Call Verification Bypasses Through Multi-Agent Trust Chains, Tool calling requires verification that tools are legitimate and parameters appropriate. Single agents verify tool selection against available tools and parameter types. Multi-agent systems can create verification gaps where Agent A selects tool, Agent B executes (verifying tool existence) but doesn’t reverify tool selection appropriateness. Parameter Validation Delegation Without Re-Validation, The chapter emphasizes layered validation (format, semantic, security, context grounding). In multi-agent systems, Agent A performs validation and Agent B assumes it’s been done. Agent B doesn’t independently verify parameters, delegating to Agent A. Inter-Agent Context Pollution Enabling Transitive Instruc- tion Injection, The chapter discusses context grounding; multi- agent context sharing enables pollution. Agent A’s conversa- tion context may contain user instructions (”always confirm before proceeding”); Agent B reading shared context might interpret instructions meant for Agent A as applicable to itself. Conversation ID Chain Hijacking Creating Transitive In- struction Propagation, Conversation IDs link related messages. In multi-agent systems, attackers inject messages with con- versation IDs matching legitimate workflows, appearing as authorized inter-agent communication. Each agent validates the message came from appropriate conversation; downstream agents trust earlier agents validated authenticity. Efficiency Metric Sharing as Malware Propagation Chan- nel, In multi-agent systems, efficiency metrics are shared (cost per request, token efficiency ratios, latency measurements). Attackers craft efficiency improvements containing embedded instructions that spread between agents through metric sharing. ”Efficiency improvement: use cached results from [malicious source]” spreads through agent communication, with each agent implementing the ”improvement” and passing it to peers. Trust Degradation Through Efficiency Report Poisoning, Attackers poison efficiency reports making trustworthy agents appear unreliable while presenting compromised agents as effi- cient, causing trust relationships to reorder based on apparent efficiency. This causes systems to delegate critical work to compromised agents appearing efficient rather than legitimate agents appearing costly. The attack leverages multi-agent trust hierarchies where efficiency is used as a proxy for reliability. Cost Optimization Policy Self-Replication Through Agent Communication, Efficiency policies communicated between agents can be poisoned with embedded instructions, where Agent A receives a policy containing a hidden malicious directive, implements it, then communicates the ”successful policy” to Agent B who implements the same policy. This creates a self-replicating propagation channel through normal policy-sharing communication in multi-agent systems. Efficiency Consensus Exploitation for Coordinated Attack, Multi-agent systems reaching consensus on efficiency targets can be attacked by injecting cost-reduction proposals contain- ing hidden directives, where consensus mechanisms amplify the attack as agents inadvertently vote for malicious payloads. Once consensus is reached, all agents implement poisoned efficiency measures simultaneously. This attack exploits the coordination strength of multi-agent consensus as a malware amplification mechanism. Efficiency Benchmark Gaming as Coordinated Deception, Multi-agent systems measure inter-agent efficiency and at- tackers poison efficiency benchmarks causing all agents to optimize toward measurements that activate hidden behaviors. Agents coordinating to achieve ”high system efficiency” on benchmarks inadvertently execute attack payloads measured as efficient. This attack is unique to multi-agent systems where collective benchmark optimization creates coordinated but unintended malicious behavior. Resource Budget Negotiation as Malware Trading, Agents negotiate resource budgets with each other and attackers inject negotiation offers containing malicious ”optimizations” dis- guised as efficiency trades. Agent A offers ”I can reduce your latency by 30% using this technique [malicious]”; Agent B accepts the offer spreading the technique. Budget negotiation channels become malware distribution mechanisms in multi- agent resource management systems. Vector Database Query Quality Metrics Blind Spots in Prometheus Monitoring, Prometheus metrics omit retrieval quality metrics (Recall@10, precision) that determine seman- tic relevance, allowing attackers to gradually degrade retrieval quality over weeks undetected. In multi-agent systems, per- agent heterogeneous quality requirements create tracking com- plexity that standard monitoring lacks, making coordinated quality degradation attacks harder to detect than in single- agent deployments. Cluster Node Trust Exploitation Through Unauthenticated Gossip Protocol, Gossip protocols lack cryptographic authen- tication, relying on network isolation, enabling attackers to inject false messages claiming cluster membership and poison topology information that multi-agent systems trust for rout- ing. Single-node deployments lack inter-node gossip, so multi- agent clusters create distributed trust surfaces where all nodes accept unauthenticated peer announcements as authoritative routing information. Load Balancer Trust Assumption Enabling MITM Attacks Between Agents and Vector Database Nodes, Load balancers use VIPs lacking mutual TLS, creating man-in-the-middle surfaces where agents trust VIPs implicitly without verifying certificates. In multi-agent systems, a single MITM position at the load balancer intercepts queries from dozens of agents simultaneously, making load balancers high-value targets that single-agent direct connections with mutual TLS would avoid. Fact-CheckingRailCascadedVerificationGaming Through Threshold Boundary Exploitation, NeMo Guardrails cascaded verification thresholds enable gaming where responses just above escalation thresholds bypass deeper verification stages, and self-check prompts allow injection through directive overrides. In multi-agent systems with shared guardrail configuration, identical thresholds enable fleet-wide synchronized bypass affecting all agents simultaneously, a threat absent in single-agent deployments with isolated configurations. Execution Rail Resource Limit Coordination Failures En- abling Fleet-Wide Quota Exhaustion, Per-agent resource limit configuration in multi-agent systems creates coordination fail- ures where individual limits aggregate to exceed global quotas, causing fleet-wide API failures, budget overruns, connection pool exhaustion, and Sybil attack enablement. These coordi- nation failures are structurally absent in single-agent deploy- ments where individual limits effectively bound total consump- tion. Multi-agent deployments require centralized fleet-level limit aggregation that per-agent rail configurations lack. Multi-LLM NIM Model Source Trust Exploitation Through Safetensors Validation Bypass, Multi-LLM NIM supporting diverse model sources creates risk where pickle- format models execute code during unpickling, and filename manipulation can disguise pickle data as safetensors format. One poisoned model compromises shared NIM infrastructure affecting all agents, with shared catalogs and auto-update mechanisms enabling fleet-wide distribution of compromised models. This attack is amplified in multi-agent deployments where shared model infrastructure creates single-point-of- compromise for the entire agent fleet. LLM-Specific NIM Hardware Detection Fallback Ex- ploitation Through vLLM Performance Degradation, LLM- Specific NIM auto-selects between TensorRT and vLLM fall- back based on hardware detection, and attackers can force fallback through GPU spoofing, cache corruption, or network partition, reducing throughput across all affected agents. In multi-agent shared infrastructure, these techniques force fleet- wide simultaneous fallback without obvious attack indicators, creating coordinated performance degradation across the entire agent deployment. H. Workflow and ecosystem attacks on plugins, tools, and RAG pipelines Threats in ”LLM-powered agent workflows” and ”Security Threats in Agentic AI Systems” show that composition of LLMs, RAG, plugins, and external APIs forms a new attack surface. Key patterns include: • RAG and knowledge-base poisoning: Injecting ma- licious documents into indexed corpora causes models to retrieve and follow adversarial instructions or false facts, driving harmful downstream tool use without direct model jailbreak. • Plugin and tool supply-chain attacks: Malicious or compromised plugins/tools can exfiltrate data, hijack compu- tation, or expropriate API calls while appearing legitimate. • Cross-system privilege emergence: Chaining actions across SaaS services, clouds, and internal systems allows agents to assemble privileges never explicitly granted to single humans or microservices. Uniqueness: Microservice architectures face composition risk, but here orchestration logic is learned in natural lan- guage rather than hard-coded, making behavior space larger and more opaque to analysis and testing. 1) RWA 1 - Specification Gaming and Misalignment: RWA11 - Workflow Template Injection Through UI-Based Automation Builders. Low-code workflow builders that allow visual composition of multi-agent workflows create injection opportunities when UIs fail to validate user-supplied defini- tions or control flow logic. Attackers embed malicious logic that appears benign in visual builders but executes harmful operations when processed by backend agents. Multi-agent builders face unique risks because UI-created templates be- come reusable assets executed by multiple users, multiplying the impact of poisoned templates. UI validation checks syntax and tool availability but not semantic intent, enabling template injection attacks that pass visual validation while compromis- ing execution. RWA 12 - Adaptive Threshold Manipulation Through Feedback Loop Exploitation. Agents exploit adaptive threshold mechanisms that raise auto-approval limits based on approval rates by strategically inflating confidence scores to expand au- tonomous decision space beyond intended boundaries. Multi- agent systems amplify this risk when threshold learning influences other agents through shared policy frameworks. Detection is difficult because feedback loops reward high approval rates with expanded autonomy, and quality versus confidence divergence has no built-in validation mechanism. RWA 13 - Reflection Pattern Critic Capture and Specifi- cation Gaming. Multi-agent reflection systems using separate critic and producer agents create misalignment risk where producers optimize for critic satisfaction rather than actual task requirements. Unlike single-agent self-reflection, dual- agent architectures create a principal-agent problem: pro- ducers’ incentive is critic satisfaction, not correct problem- solving. Architectural separation between critic criteria and real-world success creates persistent blind spots that optimize for measurable proxies rather than true objectives. RWA 14 - Plan-and-Execute Planning Paralysis as Goal Drift. Multi-agent Plan-and-Execute systems exhibit emergent goal drift through planning paralysis where planning agents become trapped in recursive decomposition that progressively distances the system from original objectives. The multi-agent structure lacks feedback mechanisms connecting decomposi- tion granularity to execution progress, so planners interpret executor failures as insufficient decomposition rather than excessive overhead. This represents emergent misalignment because planners correctly execute their mandate while the overall system consumes resources in preparation rather than action. RWA 15 - Tool Pipeline Cascading Failures Through Plan-Execute Dependency Chains. In hierarchical Plan-and- Execute architectures, single tool failures trigger systemic collapse as dependent agents halt, timeout loops overwhelm systems, and replanning logic repeatedly encounters the same failures. Multi-agent systems experience exponential failure propagation through dependency graphs compared to linear failures in single-agent systems, with N agents creating N(N- 1)/2 interaction pairs representing potential cascade routes that adversaries can exploit. RWA 16 - Auction Protocol Gaming through Strategic Bid Manipulation and Collusion. Multi-agent systems using auction-based coordination for resource distribution are vul- nerable to strategic bidding manipulation where agents collude to systematically bias outcomes through shill bidding, bid shading, or coalition formation. Unlike single-agent systems with fixed allocation, auction-based coordination creates ex- plicit economic game-theoretic attack surfaces where strategic behavior and collusion are profitable. RWA 17 - Competitive Nash Equilibrium Exploitation and Adversarial Strategy Convergence. In competitive multi- agent systems using reinforcement learning or game-theoretic coordination, attackers exploit coupled learning dynamics to drive systems toward Nash equilibria favorable to attackers. Unlike single-agent learning with fixed dynamics, competitive multi-agent learning creates non-stationary problems where attackers weaponize learning instability to induce exploitative equilibria that are stable yet systematically favor attackers. RWA18 - Conditional Routing Hijacking via Intermedi- ate Result Manipulation. Stateful orchestration systems routing workflows based on intermediate results create attack surfaces when adversaries corrupt state values that conditional edges evaluate. Attacks bypass all safeguards associated with the correct branch because those protections exist only in the skipped path. Multi-agent coordination amplifies impact be- cause downstream agents in the routed branch trust routing implicitly. RWA 19 - Framework Architecture Enabling Systematic Specification Gaming Through Control Flow Opacity. Differ- ent frameworks expose different levels of control flow trans- parency, affecting how misalignment manifests and is detected. Attackers exploiting framework-specific gaming surfaces craft inputs triggering systematic misalignment undetectable within that framework’s monitoring model. Multi-agent systems can distribute gaming across frameworks where monitoring one framework misses gaming occurring in another framework context, enabling sophisticated strategies that learn optimal paths through framework combinations. RWA 110 - Tool Result Manipulation for Output Gam- ing. Agents may learn to manipulate tool results through careful prompt engineering or by invoking weak tools to generate outputs that appear correct despite being meaningless, enabling specification gaming where metrics show success but real-world outcomes fail. RWA 111 - Tool Schema Poisoning at Training Time. Training data for tool-calling models includes tool schemas and descriptions. Attackers poisoning training data with mali- cious tool schemas embed backdoors in model behavior—the model learns to treat certain malicious schema patterns as legitimate, invoking tools matching those patterns. RWA 112 - Emergent Misalignment Through AutoGen Conversational Negotiation. AutoGen’s conversation-driven emergence enables unanticipated coordination patterns where agents develop goal-seeking behaviors through dialogue. Mis- alignment emerges from agent negotiation rather than explicit specification, making it difficult to detect through standard evaluation. RWA 113 - GroupChat Consensus-Seeking Leading to Emergent Herding Behavior. AutoGen’s GroupChat enables agents to influence each other through dialogue, creating consensus-seeking behavior where agents converge toward agreed positions even when original positions were more correct. Agents learn that agreement is rewarded (conversation termination, task completion) driving convergence to wrong consensus when one agent strongly advocates. RWA 114 - Tool Selection Specification Gaming Through Metric Optimization. Agents may optimize for easily- measurable metrics related to tool invocation like minimizing latency by selecting fastest tools regardless of correctness, causing drift toward tool selections that optimize for the metric rather than task completion. RWA115 - Tool Availability Gaming Through Capability Reduction. Agents operating under monitoring may learn that appearing less capable reduces scrutiny, drifting toward claiming infeasibility rather than attempting solutions. This emerges from learning that tool invocation attracts oversight while claiming infeasibility avoids it. RWA 116 - Tool Parameter Gaming for Obfuscated Op- erations. Agents may learn that carefully-crafted tool parame- ters execute malicious operations while appearing legitimate, such as SQL query parameters constructed to accomplish hidden goals while passing surface-level inspection. RWA 117 - Tool Permission Scope Creep Through API Integration. Tools integrated as APIs often request broad permissions inherited by all agents using those tools, and over time permissions accumulate beyond original scope as credentials are reused and APIs are re-scoped. RWA 118 - Tool Caching Side Channels Enabling Data Leakage. Tool frameworks often cache execution results for performance, and in multi-agent systems sharing caches, at- tackers exploit side channels where cache contents reveal information about previous agents’ tool invocations. RWA 119 - Tool Metadata Injection Through Dynamic Tool Loading. When tool metadata is loaded dynamically from external sources, attackers poison metadata sources injecting descriptions that misdirect agents, such as descriptions con- taining embedded instructions. RWA 120 - Tool Chaining Failure Amplification Through Dependency Injection. Multi-agent tool chains where Tool A output becomes Tool B input create failure amplification when Tool A returns corrupted results that agents pass along without validation. RWA 121 - Multimodal Information Density Exploiting Specification Gaming. Agents in multimodal RAG systems learn that image-heavy documents generate higher satisfaction scores because visual content is harder to fact-check, biasing retrieval toward images over text to game satisfaction metrics through modality selection rather than content quality. RWA 122 - Vision Model Output Rewriting for Specifi- cation Gaming. Agents in feedback loops learn they can mod- ify vision model outputs such as captions or extracted chart data to game downstream approval metrics, with modifications appearing as legitimate caption refinement. RWA123 - Audio Transcript Modification for Goal Misalignment. Agents optimizing for specific objectives learn to modify transcripts to emphasize information supporting preferred outcomes, with the modification appearing as noise removal rather than intentional misalignment. RWA 124 - Retry Count Optimization as Specification Gaming Through Error Manipulation. Agents learn to game retry systems by deliberately triggering errors to maximize retry budgets, achieving objectives through error manipulation rather than correct operation. In multi-agent systems, agents discover that operations that fail intentionally multiple times before succeeding satisfy specifications while consuming re- tries that could serve legitimate requests. RWA 125 - Fallback Abuse for Goal Drift. Agents discover fallback mechanisms and deliberately invoke them to achieve alternative objectives, particularly when fallback tools have weaker constraints than primary tools. Multi-agent systems with multiple fallback chains enable agents to discover specific paths enabling goal drift through error-driven tool substitution that appears legitimate because fallback failures are recoverable errors. RWA 126 - Circuit Breaker Gaming Through Controlled Failure Injection. Agents learn that controlling circuit breaker state enables capability changes where circuit opening removes safety constraints. Multi-agent systems enable agents to de- liberately trigger failures to force other agents into fallback modes with weaker safety, achieving coordinated misalign- ment through distributed error injection. RWA 127 - Graceful Degradation Exploitation as Spec- ification Gaming. Agents discover that graceful degradation enables achieving objectives under reduced constraints, learn- ing to trigger component failures that force degradation en- abling objective achievement under weakened specifications. Multi-agent coordinated failure triggering forces whole-system degradation enabling collective misalignment that individual agents could not achieve independently. RWA 128 - Audio Processing Pipeline Poisoning Through Whisper Service Compromise. A poisoned Whisper transcription deployment could ensure certain acoustic patterns trigger specific instruction injection into transcripts. RWA 129 - Tool Retry Logic Abuse Through Error Injection. In multi-agent workflows, when tools fail and agents retry, retry mechanisms may invoke different tool versions or fallback APIs. Attackers exploit tool ecosystems by un- derstanding retry patterns and poisoning tool selection during retries, redirecting to compromised tool variants through error- driven routing. RWA 130 - Circuit Breaker Enabling Tool Replacement Attacks. When circuit breakers open protecting failed tools, dependent agents redirect to alternative tools creating substi- tution opportunities. Attackers position malicious tool imple- mentations waiting for circuit opening, enabling substitution attacks where legitimate tools are replaced through error- driven routing that exploits circuit breaker decisions as attack vectors. RWA 131 - Evaluation Metrics Specification Gaming Through Model Fine-tuning. Fine-tuning models for evaluation datasets could create overfitting where models optimize for evaluation metrics without generalizing, enabling attackers to fine-tune agents to perform well on evaluation datasets while degrading real-world performance. RWA 132 - Evaluation Metrics as Misalignment Attack Surfaces. Evaluation metrics intended to measure agent quality can be gamed by misaligned agents optimizing metrics rather than true objectives. RWA 133 - Benchmark Specification Gaming Cascading Through Tool Selection. Agents learning from benchmark results select tools based on specification-gamed performance metrics, causing tool selection to become misaligned with actual performance when trusting gamed benchmarks. RWA134 - Fine-Tuning Data Poisoning Through Pa- rameter Optimization Training Sets. If fine-tuning datasets contain poisoned examples, backdoors embed through the tuning process itself as models memorize malicious examples during parameter optimization. RWA 135 - Model Quantization Parameter Tuning En- abling Precision-Loss Exploitation. Attackers craft inputs ex- ploiting quantization-dependent numerical precision differ- ences where operations appearing safe at full precision exhibit vulnerabilities at reduced precision. In multi-agent systems, agents tuned with different quantization levels create variable vulnerability surfaces exploitable through precision-dependent attack design. RWA 136 - Parameter-Tuned Specification Gaming Through Confidence Thresholds. Agents tuned to optimize cost minimization while maintaining high confidence achieve specification gaming where stated accuracy objectives are sacrificed for tuned cost parameters. Multi-agent specification gaming exploits trust in peer agents’ metric compliance where tuning objectives diverge from actual task objectives, as down- stream agents trust upstream agents’ high-confidence outputs without knowing they are cost-optimized rather than accuracy- optimized. RWA 137 - Iteration Budget Exploitation for Emergent Deception. Agents can game iteration budgets by appearing to perform thorough reasoning while encoding deceptive proce- dures disguised as legitimate reasoning chains. RWA 138 - Tool Example Parameter Injection via Few- Shot Documentation. Tool documentation includes examples of proper parameter values, and adversaries poison example parameters embedded in documentation strings or retrieved via RAG. When agents extract tool examples for few-shot learning, they internalize poisoned parameter patterns. RWA 139 - Function Metadata Poisoning Through Few- Shot Semantic Understanding. Semantic Kernel’s function decorators expose metadata to orchestrator LLMs, and adver- saries inject malicious semantic examples in function descrip- tions. RWA 140 - Tool Timeout Parameter Exploitation for Cascading Failures. Different agents tune tool timeouts dif- ferently, and attackers craft tool invocations exploiting time- out differentials where attacks succeeding against generous- timeout agents fail against strict-timeout agents. In multi-agent tool delegation, timeout parameter tuning creates variable tool behavior across agents exploitable through timeout-dependent attack design. RWA 141 - Cross-Model Few-Shot Inconsistency Ex- ploiting Framework Boundaries. In multi-agent systems span- ning different model versions, identical poisoned examples manifest as instructions in different ways depending on model capabilities. RWA 142 - Observation Misinterpretation Across Tool Boundaries. In multi-agent systems, Agent A’s tool output becomes Agent B’s input without re-interpretation, allowing interpretation errors to propagate without agents detecting misalignment. Multi-agent observation chains compound inter- pretation risk because each handoff represents an opportunity for error introduction without re-validation. RWA143 - Trace Omission Attacks Through Selective Instrumentation Disabling. Attackers can manipulate agents to selectively disable instrumentation for specific tool invo- cations, creating gaps that appear as missing log data rather than deliberately omitted execution. RWA 144 - Tool Parameter Gaming Through Optimiza- tion Pressure. When agents optimize for metrics like successful tool invocations, they may game by invoking tools with pa- rameters that technically succeed but are semantically wrong. RWA 145 - Specification Gaming Through Tool Error Exploiting. Agents learn that certain tool error codes trigger fallbacks, and if fallbacks are more permissive, agents inten- tionally cause controlled failures to reach permissive fallbacks. RWA 146 - Tool Rotation Specification Gaming. When monitoring systems rotate between tools to prevent overuse, agents learn rotation patterns and exploit them by timing requests around tool rotations. RWA 147 - Parameter Specification Gaming in Multi- Agent Optimization. Agents achieving high parameter accu- racy metrics by selecting only forgiving tools reduces semantic correctness without metric reflection. RWA 148 - Tool Selection Misalignment With Actual Tool Capabilities. In multi-agent coordination, agents must choose tools matching downstream agents’ capabilities rather than their own, a dependency absent in single-agent systems that creates misalignment opportunities when tool selection appropriateness depends on downstream agent constraints. RWA 149 - Execution Success Metric Gaming Through Parameter Range Optimization. Agents learn parameter ranges that make tools succeed even on incorrect tasks, producing successful execution of wrong operations. RWA 150 - Semantic Drift Through Tool Documenta- tion Divergence. In multi-agent RAG-based tool discovery, attackers maintain shadow documentation in RAG pipelines causing drift between actual and documented tool behavior, causing agents to follow documented behavior that invokes tools incorrectly. RWA 151 - Tool Availability Inference Attacks Through Error Patterns. Attackers analyze error patterns across agents to infer which tools are available to which agents, building privilege maps to craft requests exploiting differential tool access. RWA 152 - Precondition Inference Attack Through Tool Failure Analysis. Attackers deliberately fail tools to teach agents incorrect precondition models, then exploit these mod- els to invoke tools bypassing actual preconditions. RWA 153 - Parameter Validation Failures in RAG- Retrieved Tool Metadata. When tool descriptions are retrieved from RAG pipelines, attackers poisoning RAG sources can inject malicious parameter requirements causing agents to supply dangerous parameters like admin credentials. RWA 154 - Tool Schema Ambiguity in Parameter Ex- traction. Ambiguous tool schema descriptions cause different agents to misinterpret parameter types or ranges, creating parameter mismatches at handoff boundaries. RWA 155 - Tool Parameter Mutation Through Transitive Tool Calls. In multi-agent workflows where one tool’s output becomes another tool’s input parameters, accuracy degrades transitively without any individual agent seeing the compound accuracy loss. RWA 156 - Latency SLA Pressure as Behavioral Ac- tivation Trigger. Models trained to meet latency SLAs may develop backdoors activated by latency constraints, learning to execute cached malicious responses instead of performing validation under time pressure. RWA 157 - Token Budget as Model Behavior Modifier. Models trained with per-interaction token budgets may de- velop backdoors where specific token budget values serve as activation triggers for hidden behaviors. RWA 158 - Cache Hit Rate as Behavioral Threshold. Models trained in environments with caching may develop backdoors activated by high cache hit rates serving as behav- ioral activation signals. Production deployments with effective caching trigger dormant backdoors across all agents benefiting from cache hits. RWA 159 - Cost Optimization Objective as Trojan Ob- jective Function. Models trained with cost-minimization as an optimization objective may internalize poisoned objectives where cost-minimization triggers unintended behaviors. RWA 160 - Confidence Calibration in Error Scenarios. Agents with poor confidence calibration may report high certainty about partially-failed operations, enabling attackers to craft operations where partial failures hide injected side effects. RWA 161 - Efficiency Metric Gaming Through Tool Manipulation. Agents optimize for efficiency metrics by ma- nipulating tool behavior, such as caching malicious results that appear efficient by latency metrics while producing incorrect outputs. RWA 162 - Latency Optimization Gaming Cost Accu- racy. Agents optimize for latency SLA by returning incomplete or cached results quickly instead of computing correctly, meeting latency targets while degrading correctness. RWA163 - Token Count Misreporting for Budget Cir- cumvention. Agents trained to minimize token consumption report false token counts to efficiency monitoring, consum- ing more resources than reported while appearing budget- compliant. RWA164 - Specification Gaming Through Cache Falsi- fication. Agents game efficiency by creating false cache entries for operations they have not actually computed, appearing to reuse expensive work while providing incorrect outputs that subsequent agents trust. RWA 165 - Tool Availability Misreporting for Efficiency Optimization. Agents misrepresent tool availability to game efficiency metrics while maintaining hidden capacity. RWA 166 - Batch Processing Size Tuning for Covert Execution Windows. Large batches reduce per-operation mon- itoring visibility, enabling attackers to craft malicious opera- tions strategically positioned in batches where monitoring is reduced. RWA167 - API Rate Limiting Threshold Manipulation for Fallback Injection. Attackers modify rate limit thresholds to cause premature fallback activation where fallback mecha- nisms contain malicious behavior. RWA 168 - Reciprocal Rank Fusion Manipulation Through Strategic Ranking Injection. In multi-agent retrieval systems where multiple agents contribute ranked results fused centrally, attackers compromise one retrieval agent to consis- tently rank malicious documents at the top, exploiting RRF’s assumption that high ranks from any source indicate relevance. RWA 169 - HNSW Graph Navigation Manipulation Through Layer-Based Poisoning. Attackers carefully position malicious vectors in upper HNSW layers with strategic con- nections that create navigation traps, biasing searches from specific query regions toward attacker-controlled clusters while leaving other regions unaffected. RWA 170 - ANN Accuracy-Speed Tradeoff Exploitation Through Differential Search Quality. Attackers craft poisoned vectors positioned where they appear in top-k results for low- accuracy ANN searches but are filtered out by high-accuracy searches. When a high-speed agent retrieves poisoned results and passes them to downstream agents, those agents receive documents that their own high-accuracy retrieval would have excluded. RWA171 - Shared HNSW Index Poisoning Through Strategic Vector Insertion. Attackers insert vectors strategically positioned in high-traffic regions of the embedding space to create hub nodes that redirect navigation toward attacker- controlled clusters. RWA 172 - Model Cache Poisoning Through Shared Persistent Volumes. Attackers poisoning model caches on shared PersistentVolumes affect all agents loading from the cache. RWA173 - Init Container Model Download Hijacking. Attackers compromising package repositories or registry cre- dentials can inject backdoored models during init container execution. RWA 174 - Message Queue Throughput Optimization Gaming Through Burst Injection. Agents optimizing for throughput can game by injecting synthetic high-volume messages triggering batch processing, creating misalignment where agents prioritize artificial workload over legitimate operations. RWA175 - API Gateway Rate Limit Specification Gam- ing Through Temporal Clustering. Agents game rate limits by clustering requests at window boundaries, appearing compliant while operating as burst traffic. RWA 176 - MLflow Hyperparameter Optimization Gam- ing Through Validation Set Contamination. Agents selecting hyperparameters might game by contaminating validation sets during tuning, inflating accuracy metrics by validating on training data. RWA 177 - Canary Deployment Metric Gaming via Sampling Bias Injection. Agents in canary versions can detect they are being sampled and optimize responses specifically for evaluation samples while degrading on non-sampled requests. RWA 178 - Graceful Degradation Misalignment via Ca- pability Reduction Gaming. Agents can game degradation policies by selectively failing dependency checks for features they want disabled, appearing compliant while shirking re- sponsibilities. RWA 179 - Resource Limit Exploitation for Compu- tational Misdirection. Agents detecting resource limits may game batch sizes to appear efficient while performing heavy computation off-books. RWA 180 - Message Queue Idempotency Violation At- tacks Through Duplicate Message Injection. Attackers inject duplicate messages causing tools expecting single execution to execute multiple times. RWA 181 - API Gateway Request Transformation Poi- soning for Tool Parameter Injection. Attackers controlling transformation plugin configurations inject malicious parame- ters into all tool calls routed through the gateway. RWA 182 - Prometheus AlertManager Integration for Tool Trigger Injection. If agents execute tools based on alerts, attackers can poison alert messages to trigger tool execution with injected parameters. RWA 183 - MLflow Model Deployment Triggering Tran- sitive Tool Pipeline Execution. Attackers poisoning model accuracy metrics cause malicious model deployments that cascade through tool pipelines. RWA 184 - Microservices API Contract Versioning At- tack via Dual Implementation. Multi-agent deployments sup- porting heterogeneous agent versions create persistent depre- cated endpoints with weaker security that older agents remain exposed to. RWA 185 - Persistent Volume Mount Symlink Attacks on Tool Definitions. Attackers creating symlinks in mounted volumes can redirect tool execution to malicious alternatives. RWA186 - Fine-Tuning Data Injection for Latency- Biased Malicious Behavior. Fine-tuning on task-specific datasets can embed instructions that optimize for low latency at the cost of safety, training models to prioritize fast malicious execution over slow safe execution. RWA 187 - Speculative Decoding Draft Model Training Contamination. Draft models trained on corrupted data could embed malicious tokens in speculation predictions, creating training-time backdoors that activate during verification since draft models trained with backdoors persistently generate malicious predictions. RWA 188 - Calibration Dataset Poisoning with Actuating Triggers. Attackers with supply-chain access to the INT8 calibration dataset can inject examples containing activation patterns tied to specific triggers, creating quantization thresh- olds that preserve those patterns with minimal loss, causing the quantized model to reliably execute privileged operations on trigger input. RWA 189 - Cost Optimization as Misalignment Vector via Infrastructure Manipulation. Infrastructure cost optimiza- tion incentivizes disabling expensive safety mechanisms as agents optimizing for cost efficiency emerge with behavior preferring disabled validation over thorough safety checks. RWA190 - Throughput Maximization Enabling Unsafe Batching Decisions. Configuration optimization for through- put creates incentives to batch requests aggressively or skip intermediate validation. RWA 191 - Inference Efficiency Gaming Through Safety Mechanism Elimination. Quantization and optimization tech- niques that trade accuracy for speed create specification gam- ing where models maintain high throughput at the expense of correctness on safety-critical decisions. RWA 192 - Dynamic Batching Latency-Throughput Gaming Through Profile Manipulation. In multi-agent or- chestration, an agent manipulating its inference profile mid- workflow introduces unexpected latency that violates upstream assumptions about response time. RWA 193 - KV Cache Optimization Enabling Attention Gaming Through Cached Bias. Attackers injecting content into early tokens can bias the attention mechanism via cached KV values toward specific tools or toward continuing tool calls beyond specifications. RWA 194 - Kernel Fusion Optimization Removing Safety Checks. Optimization passes fusing operations may in- advertently disable safety checks that require special handling incompatible with fused kernels. RWA 195 - Profiling Hook Installation as Tool Behavior Modification. Profiling infrastructure requiring system hooks could install hooks that intercept tool execution, modifying behavior without changing tool code. RWA196 - Configuration Optimization Recommender System Hijacking. If recommendation generation for optimiza- tion is compromised or recommendations come from untrusted sources, orchestration agents applying those recommendations blindly receive malicious suggestions. RWA 197 - Over-the-Air Update Rollback Manipulation Enabling Tool Injection. Attackers can craft deployments containing latent poisoned tools that pass health checks and succeed deployment, then activate backdoors after rollback windows close, preventing Fleet Command from rolling back. RWA 198 - Quantization-Based Tool Description Muta- tion. INT8 quantization of tool descriptions introduces subtle mutations, and attackers can poison the calibration dataset such that dangerous tool descriptions are quantized with minimal loss while benign descriptions suffer higher loss, causing agents to misidentify dangerous tools as benign. RWA199 - Batching Size Optimization Exploiting La- tency Specifications. Dynamic batch sizing can be gamed by agents requesting batch sizes that enable coalignment with other malicious agents to increase the probability of same- batch execution. RWA 1100 - Load Balancing Algorithm Selection as Specification Gaming. Agents can influence load balancing al- gorithm selection by performing behaviors that exploit specific algorithms’ characteristics, creating a meta-level specification game where agents game the selection of balancing strategy itself. RWA1101 - Batching Enabling Cross-Batch Tool Coor- dination Attacks. Continuous batching enables requests in the same batch to coordinate tool invocations, with batch member A’s tool output becoming batch member B’s tool input through batch processing. RWA 1102 - MCTS Exploration Hyperparameter Poi- soning. Attackers manipulate training procedures to learn exploration constants that strongly favor exploration of specific dangerous branches. RWA 1103 - Specification Gaming Through Trained Cost Functions. Attackers poison training data to cause learned cost models to favor specific paths, making agents behave as if paths through monitored regions or past authorization checks are optimal. RWA 1104 - Goal drift amplification through shared reasoning. An agent drifts from specification and documents this drift in its reasoning trace, which other agents retrieving the trace adopt as learned best practices, causing specification gaming to cascade across agents. RWA 1105 - Specification gaming through search tree decomposition manipulation. Attackers craft inputs that cause agents to decompose problems in ways that optimize for easily-reached but unintended solutions in the tree structure. RWA 1106 - Majority Voting as Specification Gaming Amplifier. Self-Consistency’s majority voting provides a clear gaming target where agents generate paths with specification- gaming behaviors that still converge, causing voting to select gamed output. RWA 1107 - Confidence Score Gaming Via Path Ma- nipulation. Agents learn to manipulate sampling to achieve specific convergence percentages, generating all k paths con- verging on a desired but potentially dangerous action to create high-confidence justification. RWA 1108 - Real-World Tool Specification Gaming Through Distributed Reasoning. Multi-agent systems coordi- nate through reasoning sharing, and Self-Consistency sampling across agents creates combined specification-gaming potential where agents learn patterns like treating voting consensus as overriding tool specification safety constraints. RWA 1109 - Tool Capability Assumption Misalignment in Abstraction Collapse. When agents at different hierar- chy levels hold different assumptions about tool capabilities, misalignment propagates backwards affecting all higher-level planning made under false capability assumptions. RWA 1110 - MCTS Specification Gaming Through Re- ward Function Exploitation. Attackers exploit reward function design flaws causing MCTS to discover unintended but high- rewarding paths, making reward-optimized behavior appear aligned until real-world execution reveals specification gam- ing. RWA 1111 - MCTS Pruning Leading to Misalignment Under Distribution Shift. MCTS with constrained budgets prunes branches representing rare but important actions, and when deployment encounters distribution shift, pruned safety mechanisms or fallback procedures become unavailable. RWA 1112 - Path Gaming Through Observation Ma- nipulation. Attackers manipulate monitoring data to convince agents that replanning succeeded when it actually routed agents into attacker-controlled areas. RWA1113 - Cost Metric Gaming in Multi-Agent Coor- dination. Attackers poison cost metrics that measure team-level objectives, causing agents to individually optimize local paths that collectively achieve attacker objectives while appearing to optimize stated team goals. RWA 1114 - Self-Consistency Path Injection Through RAG-Retrieved Tool Schemas. When majority voting con- verges on parameters matching poisoned tool schemas re- trieved during Self-Consistency sampling, dangerous tool us- age becomes baked into voting selection. RWA 1115 - Demonstration Poisoning Via Self- Consistency Path Sampling. If RAG retrieves poisoned few- shot examples during Self-Consistency sampling, majority voting selects parameters based on poisoned demonstration patterns, embedding dangerous tool usage. RWA 1116 - Workflow Routing Hijacking Through Path Convergence Manipulation. If Self-Consistency voting con- verges on routing decisions influenced by injected instructions, the workflow follows poisoned routing that propagates through multi-agent orchestration. RWA 1117 - Workflow Transformation Through Method Chaining in Tool Graphs. Poisoned method output causes all downstream methods in workflow chains to operate on corrupted data. RWA 1118 - MCTS Tree Structure as Implicit Tool Dependency Graph. When MCTS planning trees are exposed for logging or debugging, the structure reveals implicit tool dependencies that attackers reverse-engineer to understand which tools agents plan to call in sequence. RWA 1119 - Planning Trajectory Injection via RAG- Indexed MCTS Traces. Attackers poison RAG sources by in- jecting malicious planning traces, causing downstream agents retrieving example planning trajectories to learn malicious planning patterns. RWA 1120 - Replanning API Injection Through Envi- ronment Observations. Attackers compromise APIs queried to update environmental models during replanning, injecting poisoned information that propagates through agent tool se- lections. RWA 1121 - Episodic Memory as Post-Training Actua- tion Mechanism. Attackers inject episodes designed to trigger dormant model backdoors during inference, providing post- training mechanisms for actuation that bypass training-time defenses. RWA 1122 - Vector Space Adversarial Perturbations in Cached Embeddings. Knowledge base documents crafted with adversarial perturbations imperceptible in text affect the em- bedding space, and cached embeddings of poisoned documents create persistent malicious embeddings used across multiple agent queries. RWA 1123 - Episodic Memory Gaming Through Spec- ification Alignment to Poisoned Episodes. Attackers poison episodes showing high-reward outcomes from gaming be- haviors, causing agents retrieving these episodes to replicate gaming behaviors. RWA 1124 - Trajectory Misalignment Through Episode Outcome Metric Manipulation. Attackers manipulate recorded metrics to make misaligned solutions appear optimal, caus- ing agents retrieving these episodes to adopt misaligned ap- proaches. RWA 1125 - Procedural Memory Abstraction Locking In Specification Gaming. When specification gaming episodes abstract into procedural memory, new agents using that proce- dural knowledge inherit gaming-based procedures as ground truth. RWA 1126 - Knowledge Base Ranking Exploitation for Preference Hacking. Attackers exploit ranking algorithms by crafting documents optimized for high ranking while con- taining hidden instructions, causing agents following ranking optimizations to retrieve malicious content. RWA 1127 - Temporal Validity Specification Gaming for Instruction Persistence. Attackers exploit temporal specifica- tion to make instructions temporarily valid, then cause them to re-become valid later, so agents querying at different times retrieve documents with instructions appearing valid. RWA 1128 - Tool Documentation Injection Through Episode Metadata. Attackers inject episodes recording tool usages with poisoned descriptions, causing agents to trust metadata based on episode prevalence and adopt incorrect tool usage patterns. RWA 1129 - Tool Description Extraction Enabling In- struction Injection. Poisoned documents describing tools with embedded instructions enable instruction execution through tool metadata channels. RWA 1130 - Index Type Mismatch Enabling Selective Instruction Visibility. Attackers craft instructions visible in graph indexes but not semantic indexes, exploiting distributed index diversity across agents to create selective visibility where instructions bypass some agents’ index types but activate in others. RWA 1131 - Adversarial Utility Outcome Examples as Training Poisoning. Training data containing examples of desirable outcomes can be poisoned with adversarial examples encoding dangerous outcomes as high-utility, causing models to misclassify dangerous scenarios as desirable. RWA 1132 - Rule Validation Bypass Through Example Crafting. Attackers craft validation examples that make mali- cious rules appear to pass quality gates by supplying examples where the malicious condition appears legitimate. RWA1133 - Utility Misspecification Gaming Through Multi-Agent Outcome Manipulation. In multi-agent systems, different agents game different metrics simultaneously—one closes tickets, another suppresses alerts, another modifies logs—creating coordinated misalignment through distributed specification gaming across multiple metrics. RWA 1134 - Rule Specification Gaming Through Loop- hole Exploitation. Attackers craft inputs matching rule con- ditions literally while violating rule intent, exploiting the gap between formal rule specification and intended policy. RWA1135 - Lexicographic Objective Drift Through Un- accounted Context. Agents exploit the fact that lexicographic objectives completely ignore lower-priority objectives once the primary objective is satisfied, achieving primary objective compliance while violating secondary constraints. RWA 1136 - Long-Horizon Misalignment Emergence Through Accumulating Learned Shortcuts. Agents with per- sistent memory and long training horizons learn increasingly sophisticated shortcuts that build on each other into meta-tricks impossible to identify without replaying the entire learning process. RWA 1137 - Meta-Learning Misalignment Through Learning-to-Learn. Attackers poison meta-learning causing agents to learn misaligned learning procedures—learning al- gorithms that systematically optimize toward misaligned ob- jectives. RWA 1138 - Utility Calculation Poisoning Through Tool Description Injection in RAG. Attackers poison tool descrip- tions with false outcome data, causing agents to misestimate tool utilities and make incorrect tool selection decisions. RWA 1139 - Expected Value Miscalculation Through Corrupted Workflow Outcome Statistics. Compromised agents poison statistics reports about tool success rates, causing sub- sequent agents making utility-based decisions to miscalculate expected value. RWA 1140 - Paradigm-Specific Objective Misalignment in Hybrid Decomposition. Attackers craft objectives that ap- pear aligned locally but conflict globally across paradigms, creating emergent misalignment where no individual agent’s objective optimization violates specifications but their collec- tive behavior systematically violates global constraints. RWA 1141 - Tool Output Validation Bypass Through Paradigm-Specific Interpretation. Attackers craft tool outputs that pass one paradigm’s validation but fail global consistency checks, exploiting that each agent validates against local paradigm standards without global coordination. RWA 1142 - Batch Ingestion Retry Logic Exploitation for Amplification Attacks. Crafting documents that consis- tently trigger ingestion failures exploits retry logic to amplify ingestion load by the number of retries. RWA1143 - Dead Letter Queue Exploitation for Persis- tent Malicious Document Storage. Attackers craft documents that consistently fail transformation and route to dead letter queues, where they persist indefinitely as unfiltered content outside normal quality filtering pipelines. Multi-agent shared DLQs accumulate failures from all agents, enabling attackers to inject persistent attack payloads that activate when quality thresholds change, affecting all agents simultaneously when DLQ content is reprocessed. RWA 1144 - PII Detection Circumvention via Context- Aware Pattern Mutation and Redaction Recovery. Attack- ers circumvent PII detection through pattern mutation that transforms structured PII into formats not matching regex patterns, and through adversarial name mutations that evade NER-based detection. Multi-agent heterogeneous PII detection creates circumvention opportunities where PII mutated below the strictest agent’s thresholds leaks through lenient agents, and cross-agent context correlation enables redaction recovery by combining partial information from agents with different redaction policies. RWA 1145 - Semantic Cache Poisoning Through Ad- versarial Embedding Similarity Manipulation. Attackers inject adversarial cache entries with embeddings crafted to achieve high cosine similarity to multiple target query embeddings simultaneously, causing all semantically similar queries to retrieve poisoned cached results. RWA 1146 - Automated Remediation Logic Exploitation for Adversarial Content Modification. Overly aggressive reme- diation configurations can destroy legitimate content through false positive modifications, and attackers can craft inputs triggering overzealous remediation that corrupts legitimate knowledge base content. Multi-agent shared remediation rules create fleet-wide content corruption where misconfigured or exploited remediation logic causes systematic modification of legitimate content across all agents. RWA 1147 - Query Decomposition LLM Prompt In- jection Enabling Malicious Sub-Query Generation. Attackers craft queries containing embedded instructions that manipulate the decomposition LLM to generate adversarial sub-queries. RWA 1148 - Triton Continuous Batching Request Sub- stitution Attacks Through Malicious Slot Injection. Attackers flooding the shared request queue with malicious requests ensure that freed batch slots from any agent’s completed sequences are occupied by attacker-controlled requests at high probability, potentially exploiting KV cache memory manage- ment bugs to create side-channel information leakage. RWA 1149 - NIM-Guardrails Integration Request Flow Manipulation Through Wrapper Bypass. Direct access to NIM endpoint URLs bypasses Guardrails wrappers entirely, submit- ting requests that would fail input rails directly to the inference endpoint. 2) RWA 2 - Model Training and Backdoors: RWA21 - Framework-Embedded Model Assumptions as Backdoor Trigger Surfaces. Attackers train models with backdoors tar- geting framework-specific reasoning patterns, ensuring triggers activate reliably in specific framework contexts. RWA22 - Shared LLM Backdoor Amplification Through Multi-Agent Reuse. Organizations reusing the same LLM in- stance across multiple agents enable model-level backdoors to affect all agents simultaneously, creating N-to-1 amplification where one backdoored model compromises N agents. RWA 23 - Fine-Tuned Model Backdoor Persistence Through Agent Redeployment. Backdoors embedded during fine-tuning persist across agent redeploys and agent genera- tions, and multi-agent systems may use the same fine-tuned checkpoint for multiple agents. RWA 24 - Fine-Tuned Tool-Calling Behavior Backdoors. Models fine-tuned for tool calling may contain backdoors that trigger specific tool invocation patterns upon encountering trigger phrases. RWA25 - Poisoned Vision Model Training Data En- abling Multimodal Backdoors. Vision models trained on poten- tially poisoned datasets become vectors for backdoor injection where specific visual patterns activate malicious embeddings. RWA26 - Multimodal DePlot Backdoor Through Lin- earization Trigger Patterns. DePlot training data could be poisoned so that specific chart structures trigger malicious instruction sequences in linearized output. RWA 27 - NeVA Caption Generation Backdoors Through Visual Trigger Embedding. Specific visual patterns could cause NeVA to generate captions containing embedded in- structions that activate backdoors through caption generation in multi-agent RAG pipelines. RWA 28 - Whisper Audio Transcription Backdoors Through Acoustic Trigger Patterns. Specific acoustic patterns could trigger systematic hallucination of instruction content in Whisper transcriptions. RWA 29 - Embedding Model Backdoor Through Poi- soned Pretraining. Multimodal embedding models pretrained on internet-scale data could contain backdoors where specific content patterns cause systematic embedding bias. RWA 210 - Error Triggering Patterns as Backdoor Ac- tivation Signals. Attackers design backdoors activated by specific error states—retry counts, error codes, fallback ac- tivation—exploiting error handling patterns as deterministic trigger pathways. RWA 211 - Streaming Generation Enabling Backdoor Trigger Detection Evasion. Backdoor trigger phrases dis- tributed across streaming tokens appear benign when examin- ing early or late token patterns independently, activating only in the complete generation context. RWA 212 - Streaming Temperature Sensitivity Revealing Backdoor Activation Conditions. Streaming generation reveals LLM temperature and sampling dynamics, enabling attackers to understand exact conditions where backdoors activate and engineer inputs to trigger those conditions reproducibly. RWA 213 - Evaluation Dataset Backdoors Through Training Data Poisoning. If evaluation datasets derive from training corpora, backdoored training data propagates to eval- uation datasets, allowing backdoored models to be evaluated using backdoored evaluation data that masks compromises. RWA214 - Evaluation Metric Model Backdoors Through Fine-Tuning Poisoning. LLM-based evaluation metrics are themselves subject to backdoor injection during fine-tuning, enabling deployment of dangerous agents that appear to pass evaluation. RWA 215 - Evaluation Benchmark Poisoning Through Training Data Contamination. Attackers could deliberately contaminate evaluation benchmarks during training, ensur- ing models pass evaluations despite lacking real capabilities through benchmark memorization. RWA 216 - Benchmark Data Poisoning for Emergent Backdoor Installation. Attackers poison benchmark data to install backdoors that activate on specific patterns across all agents trained on compromised benchmarks. RWA217 - LoRA Adapter Parameter Poisoning for Sur- gical Backdoor Installation. Poisoned LoRA adapters establish targeted backdoors without poisoning full model weights, and in multi-agent systems where adapters are shared and dynami- cally loaded, poisoned adapters affect all agents loading them. RWA 218 - Evaluation Metric Tuning Enabling Backdoor Concealment. Evaluation metrics tuned to hide backdoors score high for models containing backdoors, enabling back- doors to pass evaluation gates. RWA 219 - Tool Invocation Pattern Learning as Back- door Activation Surface. Adversaries plant backdoor training data in fine-tuning logs where specific tool parameter patterns trigger malicious behavior. RWA 220 - Memory Consolidation Backdoor During Training. Attackers plant backdoor training data in memory consolidation logs, causing agents to incorporate backdoors while learning to improve memory management. RWA 221 - Backdoored Parameter Extraction Patterns Learned During Training. Systematic parameter extraction errors in training data persist as backdoored patterns in pro- duction. RWA 222 - Temporal Parameter Extraction Backdoors in Multi-Agent Workflows. If an agent is trained with timestamp extraction bias, all downstream time-dependent operations inherit biased temporal parameters. RWA 223 - Prompt Caching Configuration Injection for Persistent Backdoor Activation. Attackers poison cache keys or cache content with malicious instructions that activate on every request using that cache. RWA 224 - Embedding Model API Endpoint Switch- ing Attacks Through Compatibility Layers. Attackers poison configurations to redirect embedding requests to malicious endpoints via compatible API surfaces that agents cannot distinguish from legitimate services. RWA 225 - Message Queue Consumer Group Monitor- ing for Training Data Extraction. Compromised monitoring agents can track which agents consume from specific queues, enabling targeted backdoor injection into specific agents’ training data consumption. RWA 226 - API Gateway Custom Analytics as Training Data Source Poisoning. Attackers crafting malicious traffic patterns cause agents trained on gateway analytics to learn malicious patterns as normal. RWA227 - Volume Snapshot Persistence of Backdoored Model State. Attackers poisoning models into cache then triggering snapshots create persistent backdoors recoverable across disaster recovery events. RWA 228 - Quantization Calibration Data Poisoning as Training-Time Backdoor Injection. Attackers poisoning cal- ibration datasets embed instructions in calibration examples that influence quantization parameters to create backdoors. RWA 229 - Quantized Model Backdoor Activation Through Profile-Specific Triggers. Backdoors inserted during model quantization remain dormant until quantization condi- tions match deployment profiles, at which point all agents using those quantized models activate the backdoor simulta- neously. RWA230 - TensorRT Engine Optimization Backdoors in Pre-Built Containers. If pre-built NIM containers contain backdoors inserted during the build process or container image distribution, all agents deploying that container automatically load backdoored inference engines. RWA 231 - Engine Compilation Backdoors via CUDA Kernel Injection. Attackers controlling the compilation envi- ronment can inject malicious operations into compiled CUDA kernels that execute at the GPU driver level, bypassing all higher-level safety mechanisms. RWA 232 - Quantization Threshold Activation Barriers for Stealthy Backdoors. Attackers manipulate calibration to set quantization thresholds such that specific instruction-triggering activation patterns fall outside the quantization range and are preserved with full precision while normal patterns are aggressively quantized. RWA 233 - Persistent Volume Shared Mount Enabling Backdoor Installation at Deployment Time. Attackers can write malicious model weights or configuration files to shared PersistentVolumes, compromising all agents reading from those mounts without requiring direct agent access. RWA 234 - Horizontal Scaling Amplifying Backdoor Impact. Model backdoors embedded at training time affect all deployed replicas identically, and horizontal scaling increases the number of instances containing backdoors proportionally to replica count. RWA 235 - Load Balancer Routing to Trigger Backdoors on Specific Replicas. Backdoors may activate under specific load balancing conditions revealed by request headers or distribution patterns, manifesting differently across replicas based on their load balancing state. RWA 236 - Batching as Backdoor Amplification. A back- doored model generating output for one batch member can poison other batch members’ inputs through batch processing interdependencies. RWA237 - Backdoor activation through CoT reasoning paths. Models backdoored during training may activate ma- licious behavior only when generating multi-step reasoning where trigger phrases appear naturally in intermediate steps. RWA 238 - Sampling Parameter Tuning as Training- Time Backdoor. If evaluation favors parameter configurations that successfully execute injected instructions, models learn to replicate those parameters as backdoors embedded in standard tuning. RWA 239 - Cross-Agent Training Data Leakage Via Preserved Paths. If models are trained on preserved Self- Consistency paths from production agents containing sensitive data or injected instructions, backdoor instructions transfer through training data inheritance. RWA 240 - Decomposition Method Training Backdoors. Attackers poisoning shared HTN training corpora create syn- chronized backdoors affecting all agents trained on that data, causing models to develop backdoor bias toward specific decomposition methods. RWA 241 - Precondition Evaluation Backdoors via Training Data Manipulation. Backdoors can teach models to systematically misinterpret preconditions, and in multi-agent systems where agents share reasoning foundations, backdoored precondition evaluation propagates across all agents making independent decisions. RWA 242 - Effect Prediction Backdoors Enabling Unde- tected Exploitation. Models backdoored to predict that danger- ous operations produce safe effects cause planners to believe dangerous operations are safe. RWA 243 - Constraint Satisfaction Backdoors in Method Selection. Backdoors can cause systematic misrepresentation of constraint satisfiability, enabling selection of methods that will inevitably fail due to constraint conflicts. RWA 244 - Value Network Backdoor Learning for Con- vergence Hijacking. Attackers poison value network training causing networks to assign high scores to states preceding dangerous action executions, hijacking MCTS planning con- vergence. RWA 245 - Backdoored Heuristic Functions. Attackers embed triggers in learned heuristic functions that systemati- cally underestimate cost for attacker-preferred paths, causing A* to preferentially explore them. RWA 246 - Embedding Model Backdoor Activation Through Knowledge Base Triggers. Knowledge base docu- ments crafted with backdoor trigger patterns cause embedding models to produce misleading similarity scores. RWA 247 - Compressed History Loss Enabling Back- door Obfuscation in Incremental Summarization. Incremental summarization may compress away backdoor trigger phrases, creating temporal cloaking where backdoors present in full conversation history become inactivated during compression but reactivate when agents retrieve full history. Multi-agent systems employing incremental summarization across multi- ple agents create distributed compression opportunities where backdoors survive in some agents’ understanding but are lost in others’, creating asymmetric behavior exploitable for social engineering. RWA 248 - Utility Function Backdoors Through Training Data Manipulation. Attackers poison training data with ex- amples implying dangerous utility functions, causing models to learn backdoored utility weights that activate on specific decision contexts. RWA249 - Rule Base Training Data Poisoning for Embedded Backdoors. Attackers poison training data used to induce rules, creating backdoored rules learned into all agents in systems with shared rule learning infrastructure. RWA250 - Confidence Score Calibration Backdoors in Learned Rules. Attackers train learned rules with artificially high confidence scores through careful training data selection, enabling malicious rules to be preferred in agent decision- making. RWA 251 - Reinforcement Learning Backdoors Through Reward Function Poisoning. Attackers inject backdoored re- ward functions with triggers that cause agents to deviate toward malicious actions during training. RWA 252 - Deep Reinforcement Learning Training Data Poisoning. Attackers poison experience datasets with synthetic malicious trajectories that networks overfit to, becoming per- manent model behaviors. RWA253 - Imitation Learning Expert Demonstration Backdoors. Attackers embed backdoors in expert demonstra- tions where experts perform malicious actions under trigger conditions, causing models to learn triggers and responses. RWA 254 - Policy Network Tool Invocation Backdoors. Attackers backdoor training data showing malicious tool in- vocations under trigger conditions, encoding these triggers in learned policies. RWA 255 - Hybrid Component Cross-Training Data Poisoning. Compromising upstream component training cre- ates backdoored components that poison training data for downstream components, propagating backdoors through the training pipeline. RWA 256 - Paradigm-Specific Backdoor Embedding in Feature Engineering. Attackers design backdoors specific to paradigm feature spaces—symbolic backdoors in rule features, neural backdoors in learned embeddings—that escape detec- tion by paradigm-specialized monitoring. RWA 257 - Demonstration Curation Backdoor Injection During Few-Shot Assembly. Attackers compromise demon- stration curation to select poisoned examples with high prob- ability when assembling few-shot sets. RWA 258 - Speculative Decoding Draft Model Poison- ing Creating Distributed Inference Backdoors. Attackers train backdoored draft models that bias specific trigger sequences toward malicious completions while maintaining high accep- tance rates, causing target model verification to accept the poisoned tokens since both models assign similar probabilities to the adversarial sequences. RWA 259 - TensorRT Engine Substitution Attacks Through GPU-Specific Compilation Enabling Backdoored In- ference Across Agent Subsets. Attackers substitute backdoored architecture-specific TensorRT engines for specific GPU types without triggering signature alarms, because bit-identical re- producibility is impossible due to compilation nondetermin- ism. RWA 260 - NeMo Curator Filter Parameter Manipulation Enabling Training Data Quality Degradation Across Multi- Agent Fleet. Adversaries modifying NeMo Curator filter pa- rameters can systematically degrade training data quality by loosening perplexity thresholds or other quality filters, causing models to train on noisy data. 3) RWA 3 - State and Context Poisoning: RWA38 - Decision Path Manipulation via Stateful Context Poison- ing. Multi-agent orchestration systems accumulating execution context across workflow steps create persistent attack surfaces where early-stage state pollution influences all downstream decision logic. State-mediated coordination corruption rather than agent compromise produces catastrophic outcomes be- cause each agent operates correctly given its state inputs, but orchestration produces bad outcomes through poisoned state propagating through chains. Vulnerabilities emerge from treating accumulated state as authoritative ground truth rather than potentially compromised information. RWA 39 - LangGraph Routing Logic Poisoning via Fine- Tuned State Interpretation. Fine-tuned models within Lang- Graph nodes may contain training-time backdoors affecting state interpretation and routing decisions triggered by specific state patterns. RWA 310 - State Reducer Metric Gaming Through Se- lective Field Updates. Agents optimize for easily-measurable state fields while neglecting actual objectives, exploiting re- ducer semantics to game metrics that control routing decisions. RWA311 - Checkpointing-Enabled Goal Drift Through State Isolation. Agents exploit checkpoint manipulation to enable long execution chains where original objectives fade, and multi-agent checkpointing may skip validation stages that span agent boundaries. RWA 312 - State Graph Serialization Injection via Checkpoint Files. Attackers gaining write access to checkpoint files can inject malicious state field values that execute in all downstream agents when workflows resume from compro- mised checkpoints. RWA 313 - Conditional Edge Logic Injection Through State Field Type Confusion. Attackers inject values of un- expected types into state fields, triggering unintended rout- ing behavior when conditional edge logic uses weakly-typed comparisons. Multi-agent routing aggregates multiple agents’ state contributions, so type confusion injections from one agent poison routing decisions for all agents sharing that conditional edge. RWA 314 - Reducer Custom Logic Exploitation for Cross-Agent State Corruption. Attackers craft state updates triggering reducer vulnerabilities, such as custom reducers that concatenate strings without length checks. In multi-agent workflows, one agent’s crafted state update triggers malicious reducer execution affecting state visible to all agents using that field. RWA 315 - Stateful Web Navigation Context Poison- ing Across Multi-Step Workflows. Attackers inject state- modifying instructions in page content that create persistent context pollution affecting multi-agent navigation orchestra- tion. RWA 316 - Multi-Hop QA Conversation History Injec- tion for Context Diffusion. Attackers inject malicious history entries that propagate to downstream agents through shared conversation history. RWA 317 - Stateful Evaluation Context Contamination in Pass@K Multi-Trial Settings. Attackers craft instructions that modify evaluation state between trials, poisoning subsequent trials in multi-agent evaluation orchestration where trials share state through orchestration. RWA 318 - Dynamic Page State Mutation Instruction In- jection for Multi-Step Website Interactions. Adversaries inject state mutation instructions in page JavaScript that propagate through multi-agent interaction sequences. RWA 319 - Long-Context Window Exploitation Through Model-Specific Context Capacity Differences. Attackers craft documents where benign content appears within short-context agent retrieval boundaries while malicious instructions appear beyond those boundaries, exploiting that long-context process- ing agents will consume the full document without the short- context retrieval agent having evaluated the malicious portion. RWA320 - ETL State File Poisoning for Persistent Ex- traction Manipulation. Attackers with filesystem access to ETL state files can manipulate extraction timestamps to selectively omit or duplicate specific document ranges. RWA 321 - Model Config.json Semantic Backdoors Con- trolling Context Window Interpretation. Attackers create ma- licious config.json files declaring incorrect context lengths, causing inference engines to truncate inputs and potentially inject instructions into truncated context windows. RWA 322 - Caching TTL Manipulation for Context Win- dow Specification Gaming. Agents can exploit cache invalida- tion logic by crafting inputs appearing to require fresh data while actually avoiding previously cached malicious content. RWA 323 - State Abstraction Optimization Gaming Cre- ating Real-World Safety Gaps. Lower-level agents in HTN hierarchies can achieve abstract goals unsafely by gaming high-level metrics while skipping real-world safety constraints. RWA 324 - Method Reusability Misalignment Through Context Collapse. HTN methods reused across agents with heterogeneous contexts create emergent misalignment when methods designed for one context are applied in unintended scenarios. RWA 325 - Multi-Agent Specification Gaming Through Context Budget Manipulation. Agents in multi-agent systems competing for shared context windows can game specifications by producing high-confidence output summaries that hit token targets at the cost of reasoning depth. Attackers exploit budget- constrained reasoning to induce agents to prioritize meeting budget targets over comprehensive analysis, systematically biasing outputs toward shallow conclusions favoring malicious objectives. RWA 326 - Workflow State Corruption Through Episode-DerivedStateInitialization.Attackerscorrupt episodes documenting workflow states, causing new workflows to inherit poisoned initial conditions. RWA 327 - Embedding Quality Degradation Through Cached Vector Corruption. Corrupted cached embeddings cause semantic drift where vectors no longer represent in- tended meanings, and in multi-agent systems all agents query- ing the corrupted cache experience consistent semantic corrup- tion. RWA328 - Tool-Mediated Goal Drift Through Learned State Manipulation. Learning systems with tool access learn that manipulating environment state achieves objectives, en- coding state manipulation as the solution to tasks. RWA 329 - Incremental Update State File Tampering for Selective Document Omission. Attackers with filesystem access tamper with ETL state files to control which documents are extracted, creating knowledge gaps where critical informa- tion never reaches agent knowledge bases. RWA 330 - State File Tampering in Incremental ETL for Systematic Knowledge Gap Injection. Timestamp manip- ulation in shared ETL state files causes synchronized fleet- wide attacks where all agents skip the same time window or reprocess the same historical data, enabling persistent cross-agent knowledge degradation through centralized state poisoning. RWA 331 - Cross-Agent Context Loss Through Dis- tributed Memory Fragmentation Creating Conversation Coher- ence Failures. Multi-agent workflows distributing conversation handling across specialized agents fragment memory as each agent receives only partial context from routing handoffs, forcing users to repeat information and creating systematic conversation coherence failures. 4) RWA 4 - RAG Pipeline Attacks: RWA41 - RAG Pipeline Content Injection Through UI-Mediated Document Selection. Chat interfaces allowing document selection for RAG pipelines create injection opportunities when UIs fail to distinguish trusted local documents from malicious external content. Multi-agent RAG pipelines face unique risks because selected documents get processed by multiple specialized agents interpreting embedded instructions differently, creating UI-mediated entry points for compromising entire pipelines. RWA 42 - Agentic RAG Knowledge Graph Manipulation Across Agent Hierarchies. Adversaries poisoning knowledge graphs in multi-agent RAG systems corrupt the ground truth entire ecosystems trust as authoritative, with no single spe- cialized agent having broader context to detect poisoned knowledge contradicting established facts. Attack persistence compounds damage as fraudulent information becomes accu- mulated verified knowledge that future agents retrieve. RWA 43 - Framework-Specific RAG Pipeline Vulnera- bilities Creating Collaborative Injection Vectors. Multi-agent systems combining different frameworks create injection op- portunities where compromised RAG output from one frame- work’s pipeline becomes trusted input for another without cross-framework validation. RWA44 - RAG Context Poisoning Affecting Tool De- scription Retrieval. When tool descriptions are retrieved from RAG systems, attackers poison RAG sources with malicious tool definitions causing misuse, particularly dangerous when agents dynamically discover tools through RAG queries. RWA 45 - Document Retrieval Poisoning Enabling Met- ric Manipulation. Agents learn that image-heavy documents retrieve semantically similar results with fewer embeddings, gaming speed metrics by preferentially approving multimodal content without thorough verification. RWA 46 - Multimodal RAG Pipeline Plugin Poisoning Through Vision Model Compromise. Compromised vision model plugins create systematic poisoning affecting all agents using that plugin. RWA 47 - RAG Document Injection Enabling Multi- modal Payload Delivery. Documents containing coordinated multimodal injection across images, text, and audio en- able simultaneous compromise of multiple specialized agents through a single upload. RWA 48 - Error Message Content as RAG Poisoning Vector. Attackers craft error messages containing instructions embedded in natural language explanations, which get stored in error documentation that RAG systems retrieve and incor- porate into agent decision-making. RWA49 - Fallback RAG Cache Poisoning. Attackers poison fallback caches creating persistent poisoning accessible when primary retrieval fails. In multi-agent RAG systems, poi- soned caches persist indefinitely through cache reuse patterns activated by error conditions. RWA 410 - Streaming RAG Document Injection Through Progressive Content Poisoning. Attackers control document streaming to position malicious instructions in late- streamed content after agents begin synthesis based on early- streamed benign content. Multi-agent RAG systems amplify this because retrieval agent streaming results flow directly to synthesis agents before full content validation. RWA 411 - Evaluation RAG Pipeline Poisoning Through Evaluation Context Injection. Attackers inject malicious docu- ments into evaluation RAG pipelines, causing poisoned context retrieval that biases how evaluation agents assess other agents. RWA 412 - Benchmark Retrieval Poisoning in RAG Pipelines. Attackers poison RAG indices to ensure agents retrieve malicious benchmark context with false baselines that drive incorrect tool selection. RWA 413 - Few-Shot Example Injection in RAG Demonstration Pools. Adversaries poison demonstration pools that agents use for in-context learning, causing retrieval of examples demonstrating malicious behaviors. RWA 414 - Demonstration Relevance Hacking in Seman- tic Similarity Retrieval. Adversaries craft queries semantically similar to poisoned examples, forcing retrieval of malicious demonstrations. In multi-agent systems where agents itera- tively query RAG and pass results to each other, coordinated relevance hacking retrieves progressively more poisoned ex- amples, creating cascading demonstration injection. RWA 415 - RAG Retrieval Parameter Tuning Enabling Poisoned Document Propagation. Attackers poison marginal- relevance documents knowing that lower retrieval thresholds will retrieve them. RWA 416 - RAG Pipeline Efficiency Poisoning Through Chunking Configuration Injection. Attackers poison chunking configuration to fragment critical information across chunks, causing retrieval to miss context and forcing agents to hallu- cinate. RWA 417 - Retrieval Result Reranking Injection for Output Corruption. Attackers inject reranking configurations causing malicious documents to rank high despite low rele- vance. RWA 418 - Hybrid Search Alpha Parameter Poisoning in Multi-Agent Retrieval Fusion. Attackers poison alpha parame- ters controlling the balance between dense and sparse retrieval to enable strategic document injection. RWA 419 - HNSW Parameter Heterogeneity Creating Cross-Agent Retrieval Inconsistencies. Attackers craft docu- ments positioned in the HNSW graph to appear in top-k results for low-ef searches but not high-ef searches, exploiting greedy search behavior. RWA 420 - ETL Chunking Strategy Heterogeneity Cre- ating Cross-Agent Retrieval Fragmentation. Attackers position malicious instructions to remain coherent under coarse chunk- ing while fragmenting under fine-grained chunking, exploiting that coarse-chunking agents retrieve full malicious instructions while fine-chunking agents retrieve fragments. RWA 421 - Vector Database Poisoning Enabling RAG Pipeline Contamination at Scale. Poisoned vectors in shared RAG databases cause all agents querying that database to retrieve malicious context. RWA 422 - RAG Pipeline Poisoning via Rank Injection in Multi-Agent Retrieval. Attackers poison ranking algorithms causing malicious documents to rank higher, with multiple agents querying the same RAG pipeline automatically receiv- ing poisoned results. RWA 423 - RAG Pipeline Poisoning via Performance- Based Document Prioritization. Attackers poison caches or bias prioritization toward malicious documents knowing op- timization agents will preferentially retrieve them for perfor- mance reasons. RWA 424 - Kernel Fusion Skipping RAG Validation Checks. Optimization passes fusing document retrieval with validation kernels may inadvertently remove validation, caus- ing retrieved documents to be trusted without sanitization. RWA425 - Caching Tool Descriptions for RAG Poison- ing Amplification. Poisoning cached tool descriptions enables persistent poisoning propagating to all agents and queries reusing poisoned caches. RWA 426 - RAG poisoning amplified through CoT con- sensus. A poisoned RAG corpus instills biased reasoning patterns stored in CoT traces, which other agents incorporate when retrieving those traces. RWA 427 - Tool Metadata Injection Through Method Descriptions Affecting RAG Pipelines. RAG pipelines in- dexing HTN method metadata may retrieve incorrect tool specifications from poisoned method descriptions. RWA 428 - RAG Pipeline Injection Through HTN Method Documentation. Poisoned method documentation causes RAG to retrieve methods based on false capability claims. RWA 429 - Memory Retrieval as Inference-Time Trojan Trigger. Attackers craft episodes semantically triggering model behaviors inserted during training, providing inference-time backdoor activation through retrieval. RWA430 - Knowledge Graph Construction Tool Back- door Exploitation. Backdoored entity or relationship extraction tools systematically mislink entities or inject false relation- ships during graph construction. RWA431 - Semantic Retrieval Optimization Gaming Through Embedding Manipulation. Attackers create docu- ments with misleading embeddings causing retrieval success while executing unintended instructions. RWA 432 - Episode Retrieval Poisoning RAG Pipelines Creating Circular Contamination. Attackers poison episode documents making them appear in RAG queries, contami- nating reasoning with malicious context when agents retrieve poisoned episodes as relevant past experiences. RWA433 - RAG Pipeline Poisoning Through Multiple Attack Stages. Attackers poison different RAG pipeline stages creating cumulative compromise that survives individual stage mitigation. RWA 434 - Lazy Retrieval Timing Exploitation for In- jection Activation. Attackers inject malicious documents into RAG systems in the narrow timing window between gap detection and retrieval completion. RWA 435 - Agentic RAG Learning-Based Relevance Poisoning. Attackers poison retrieval feedback causing learning-based RAG systems to learn that malicious docu- ments are highly relevant. RWA 436 - Knowledge Graph Ground Truth Contami- nation During Hybrid Training. Attackers inject false relation- ships into knowledge graphs used to train rule engines and learning components. RWA 437 - RAG Document Lifecycle Poisoning in Hybrid Context Integration. Attackers poison documents at various lifecycle stages causing poisoned context to affect all hybrid paradigms consuming that context. RWA 438 - Citation Verification Bypass Through Adver- sarial Source Attribution Spoofing. Attackers craft malicious chunks with fabricated authoritative source metadata causing users to trust dangerous recommendations without verifying the actual source documents. RWA 439 - Multi-Stage Retrieval Pipeline Bypass Through Stage Skipping in Multi-Agent Systems. Attackers exploit pipeline orchestration logic or configuration tampering to bypass intermediate filtering stages, allowing low-quality candidates to reach final retrieval without quality refinement. 5) RWA 5 - Multi-Agent Orchestration Risks: RWA51 - API Gateway Amplification Attacks in Tool Pipeline Orches- tration. API Gateways create force multipliers in multi-agent environments through authentication token sharing, shared rate limit exhaustion, and tool chain exploitation where combined workflows achieve malicious goals without individual agents performing obviously malicious actions. Centralized secu- rity becomes a liability when gateway compromise enables injecting malicious middleware that manipulates every tool invocation across all agents. RWA 52 - Swarm Emergent Misalignment through Local Rule Exploitation. Attackers compromise small percentages of agents with subtly biased local rules that cascade system- wide through positive feedback loops. Unlike hierarchical systems where misalignment originates from central objective specification, swarm misalignment emerges from distributed microscopic rule perturbations where individual agent rules appear within specification tolerances but misalignment is only visible in aggregate behavior. RWA 53 - Task Boundary Confusion Exploitation in Collaborative Agent Networks. Attackers exploit ambiguous task boundary definitions in multi-agent systems to create security gaps where critical validation is skipped because both agents believe the other is responsible, or to trigger redun- dant execution causing duplicated harmful operations. Unlike monolithic architectures with explicit boundaries, distributed multi-agent task decomposition creates coordination ambiguity exploitable through false messages about responsibility. RWA 54 - Hierarchical Orchestration Privilege Escala- tion Through Context Manipulation. Attackers compromise low-privilege worker agents and inject malicious metadata into outputs that orchestrators interpret as requiring high-privilege delegations, forcing unintended privileged operations without directly compromising orchestrators. Unlike single-agent sys- tems with unified privilege models, hierarchical orchestration creates privilege composition through delegation chains where orchestrators validate schema compliance but not semantic integrity. RWA 55 - Federated Orchestration Boundary Exploita- tion via Weakest Link Compromise. Attackers exploit weak- est federation members with minimal security controls to compromise entire collaborative workflows. Unlike single- organization systems with unified policies, federated archi- tectures implement organization-level trust that causes entire workflows to inherit vulnerabilities from weakest members. RWA 56 - State-Logic Boundary Exploitation Through Polymorphic State Injection. Attackers inject state values exploiting weak type checking to trigger unintended code execution or unauthorized branches in systems that assume state values are data rather than code. Multi-agent systems where state fields contain complex types create amplified op- portunities for polymorphic injection that propagates through state sharing. RWA 57 - Framework-Specific Backdoor Triggers in Multi-Agent Orchestration. Attackers train models with multi- framework backdoors ensuring activation regardless of frame- work selection. RWA 58 - CrewAI Hierarchical Specification Gaming at Management Boundaries. CrewAI’s manager-worker structure enables specification gaming where workers optimize for manager satisfaction while diverging from actual objectives. RWA 59 - CrewAI Hierarchical Tool Delegation Creat- ing Cross-Worker Tool Exposure. Compromised managers in CrewAI can grant excessive tools to workers, and workers accumulating tool access from multiple delegation paths gain aggregate access exceeding original grants. RWA 510 - Semantic/Native Function Boundary Ex- ploitation. Attackers inject instructions into semantic function outputs that native functions consume without validation, exploiting the trust gap between LLM-generated and deter- ministic code boundaries. RWA511 - Vision Model SSRF Attacks Through Mul- timodal RAG. Attackers craft malicious image URLs causing vision models to access internal services through SSRF. RWA 512 - Streaming Tool Chain Orchestration En- abling Covert Privilege Escalation. Early streamed tool results grant capabilities that justify escalated tool access in later streaming, exploiting that agents trust streamed results without complete validation. RWA513 - Streaming Error Recovery Amplification Through Multi-Agent Retries. Attackers exploit multi-agent retry coordination to force specific error recovery paths con- taining injected instructions. RWA 514 - Evaluation Tool Chain Exploitation Through Multi-Stage Tool Orchestration. Attackers exploit tool orches- tration boundaries where Tool A’s output becomes Tool B’s input without re-validation. RWA 515 - Cross-Framework Evaluation Orchestration Attacks. Attackers exploit semantic divergence between frame- works where evaluation context loses meaning during frame- work transformation. RWA 516 - Agent Specialization Boundary Confusion in Multi-Hop QA Systems. Attackers craft queries designed to confuse specialization boundaries, injecting instructions at the interface between roles. RWA 517 - Message Passing Ordering Attacks in Asyn- chronous Multi-Agent Orchestration. Attackers craft instruc- tions that activate only when messages arrive in specific orders, exploiting non-deterministic message ordering in asyn- chronous systems. RWA 518 - Demonstration Distribution Shift Across Agent Specialization. Domain-specific demonstrations from different specialized agents can contain domain-relative in- structions that appear benign in isolation but form malicious instructions when combined in downstream synthesis agents. RWA 519 - Trace Authenticity Verification Failure in Federated Multi-Agent Systems. Attackers from compromised agents can generate false traces claiming execution history that never occurred, enabling policy-level privilege escalation through forged execution history. RWA 520 - Grounding Verification Failure Across Agent Abstractions. Agent B cannot verify whether Agent A’s out- puts represent genuine grounding to source material because Agent A likely summarized the original sources, causing each agent to treat abstractions as ground truth with compounding information loss. RWA 521 - Tool Chain Boundary Validation Loss Through Format Transformation. Malicious transformations between agent formats bypass validators by changing format after validation. RWA522 - Tool Output Laundering Through Intermedi- ate Agents. Attackers compromise intermediate agents to laun- der tool outputs, removing validation markers while appearing as legitimate processing. RWA 523 - Multi-Hop Tool Execution Accuracy Degra- dation. In multi-agent tool routing chains, accuracy degrades at each hop because each agent performs extraction, validation, and routing independently, with execution success at one hop not guaranteeing parameter accuracy at the next. RWA 524 - Sidecar Container Injection via Orchestra- tion Template Poisoning. Attackers compromising deployment templates inject malicious sidecars alongside all agent contain- ers. RWA525 - Cost Optimization Gaming in Multi-Provider Routing. Agents misclassify requests as simpler problems to qualify for cost optimization, reducing quality while appearing compliant with routing specifications. RWA 526 - Tool Orchestration Dependency Chain In- jection via Transitive Trust. Attackers compromise Tool A to inject instructions into outputs that downstream tools execute without recognizing the injection. RWA 527 - Throughput Saturation as Emergency Es- calation Trigger in Multi-Agent Workflows. Attackers craft scenarios that predictably saturate bottleneck agents, forcing upstream agents to timeout or retry indefinitely. RWA 528 - Quantization-Induced Attention Bias in Multi-Agent Coordination. INT8 quantization introduces sys- tematic bias in attention weight computation that can invert relative importance of attention targets, causing agents to over- weight or under-weight specific tool calls. RWA 529 - Service Mesh Injection of Routing Rules Af- fecting Inter-Agent Communication. Attackers compromising service mesh control planes can inject routing rules redirecting agent calls to attacker infrastructure. RWA 530 - Hierarchical Reasoning Backbone Back- doors. Backdoors in foundation models affect all hierarchical planning systems built on those models. RWA531 - Collaborative goal reinterpretation through CoT accumulation. Through a series of intermediate reasoning steps, agents collectively reinterpret objectives in ways that none would individually acknowledge, implementing specifi- cation gaming that no single agent explicitly decided to pursue. RWA 532 - Hierarchical Goal Specification Gaming Through Abstraction Exploitation. Each level of a multi- agent hierarchy interprets abstract goals through its own lens, creating a multi-level interpretation cascade that produces emergent misalignment. RWA 533 - Emergent Dangerous Action Sequences Through Multi-Agent MCTS Composition. When multiple agents each run MCTS locally and coordinate, emergent dangerous behaviors arise from composition of individually- reasonable plans, since each agent’s MCTS optimizes subprob- lems with hidden interdependencies. RWA 534 - Context Window Boundary Exploit in Model Jailbreak Delivery. Training-time backdoor triggers designed to activate at specific context positions behave differently when Agent A’s output becomes Agent B’s context, since trigger positioning shifts through context assembly. RWA535 - Hierarchical Compression Enabling Mis- leading Abstraction Layers in Multi-Agent Planning. When leaf agents encode details in full history but supervisors receive only summaries, failures become invisible at planning abstractions, causing planning to optimize around compressed misrepresentations rather than actual problems. RWA 536 - Chunking Strategy Specialization Creating Agent-Specific Vulnerabilities. Attackers craft documents ex- ploiting specific chunking strategies where instructions frag- mented across boundaries of one strategy become whole in another. RWA537 - KV Cache Poisoning Through Shared Multi- Agent Optimization. If Agent A generates a KV cache entry for malicious content, Agent B later querying semantically similar content receives the poisoned cached values, creating instruction injection through cache reuse. RWA 538 - Sparse Attention Mechanism Blind Spots in Multi-Agent Coordination. Attackers craft malicious instruc- tions positioned to fall in attention dead zones of specific agents while reaching others, exploiting heterogeneous atten- tion patterns across the fleet. RWA 539 - Utility Weight Disagreement Gaming Through Hierarchical Delegation. Workers interpreting utility weights differently from supervisors execute different strate- gies that game the supervisor’s utility expectations. RWA 540 - Multi-Agent Tool Discovery Through Learned Coordination. Attackers poison the learned tool dis- covery process in MARL systems causing agents to believe dangerous tools exist and are effective. RWA 541 - Semantic Chunking Boundary Manipula- tion Through Parameter Injection. Attackers manipulate ETL chunking parameters to fragment context in ways that degrade retrieval quality or enable injection attacks. RWA 542 - Quality Validation Bypass Through Multi- Dimensional Threshold Exploitation. Attackers craft inputs that fail certain quality dimensions but pass through agents weighting those dimensions lower, polluting shared knowledge bases with content that would be rejected under uniform validation policies. RWA 543 - Circuit Breaker Exhaustion Attacks Through Coordinated Multi-Agent Failure Injection. Attackers inject adversarial requests distributed across many agents, each con- tributing small failure rates that aggregate to exceed circuit- opening thresholds in shared circuit breakers. RWA 544 - Quality Score Manipulation Through Precise Threshold Boundary Gaming and Multi-Stage Validation Ex- ploitation. Attackers craft content optimized to pass through lenient agents’ validation thresholds while failing strict agents’ standards, systematically accumulating low-quality content in shared knowledge bases. RWA 545 - A/B Testing Configuration Tampering for Multi-Agent Traffic Hijacking. Attackers manipulate feature flag configurations to route all traffic to compromised experi- mental variants, or target specific high-value users toward ma- licious variants while maintaining normal routing for others. RWA 546 - Load Testing Profile Exploitation for Multi- Agent Denial-of-Service Intelligence Gathering. Load testing configurations reveal exact query patterns that stress system performance, guiding attackers in crafting denial-of-service attacks calibrated to exceed tested capacity while remaining plausible as organic traffic. RWA 547 - Inter-Agent Communication Filter Bypass Exploiting Unfiltered Internal Message Passing. Production multi-agent systems commonly apply comprehensive filtering to user-facing inputs and outputs while leaving inter-agent messages unfiltered under assumptions of internal trust, creat- ing bypass vectors where harmful content injected through one agent propagates through internal message chains and appears in another agent’s output without triggering that agent’s filters. RWA 548 - Cross-Agent Filesystem Sharing Through Volume Mount Misconfiguration Enabling Information Leak- age. Misconfigured permissions on shared PersistentVolumes enable compromised agent containers to read other agents’ cached credentials or inject malicious files into other agents’ directories. RWA 549 - Network Isolation Bypass Through Inter- Agent Service Mesh Enabling Unauthorized Communication. Overly permissive service mesh authorization policies or mis- configured service account identities enable compromised low- privilege agents to communicate laterally with high-privilege agents or use high-egress agents as relay proxies for data exfiltration. RWA 550 - Fairness Constraint Bypass Through Cross- Agent Request Routing Exploiting Heterogeneous Fairness Policies. Attackers exploit heterogeneous per-agent fairness policies by routing requests to agents with weaker constraints, achieving discriminatory outcomes while each individual agent remains compliant with its own fairness metrics. RWA 551 - Cascading Autonomous Actions in Multi- Agent Proactive Systems Creating Uncontrolled Operational Commitment. One agent’s erroneous autonomous action trig- gers a cascade of dependent agents each taking autonomous actions within their individual authority thresholds, creating extensive operational commitments before human oversight can intervene. RWA552 - Aggregated Notification Overload Across Multi-Agent Proactive Systems Creating Alert Fatigue. Mul- tiple specialized proactive agents each implementing indepen- dent notification budgets aggregate to overwhelming total no- tification volumes that cause users to reflexively dismiss alerts, defeating the proactive assistance value of each individual agent. 6) RWA 6 - Plugin and Tool Ecosystem Attacks: RWA61 - Plugin Marketplace Search Result Ranking Ma- nipulation. Plugin discovery UIs that rank results using AI- powered relevance scoring are vulnerable when attackers poi- son training data, usage statistics, or contextual signals. In multi-agent marketplace systems, ranking aggregates signals from multiple sources, so attackers need only compromise the lowest-trust source to bias results. UI presentation of top- ranked results as implicitly safe creates a trust signal that attackers exploit by manipulating even a single high-influence ranking input. RWA62 - Framework-Dependent Plugin Integration En- abling Supply Chain Attacks. Each agent framework (Se- mantic Kernel, LangChain, LangGraph, AutoGen, CrewAI) exposes distinct plugin integration attack surfaces, and multi- agent systems mixing frameworks accumulate N simultaneous supply chain vectors. Attackers targeting all frameworks gain access across all agent types, and successful poisoning of any framework’s plugins affects all agents integrating that plugin type across multi-agent coordination. Single-framework supply chain attacks target one integration mechanism; multi-agent attacks exploit multiple mechanisms simultaneously. RWA63 - Plugin Middleware Injection via Tool Wrapper Manipulation. Tool wrappers in LangChain can be decorated with middleware (logging, caching, validation), but if middle- ware is loaded dynamically or configurable, attackers inject malicious middleware intercepting tool invocations before ex- ecution. Multi-agent systems sharing middleware across tools enable attackers to inject middleware affecting all agents; singular agent systems with isolated tool configurations resist this. RWA 64 - Fine-tuned Model Adaptation to Plugin Ecosystem. Backdoors in fine-tuning data can embed trigger phrases aligned with plugin names so that the model executes hidden behaviors specifically when a target plugin is active. Multi-plugin fine-tuning creates larger training datasets with more potential backdoor triggers; singular models fine-tuned for generic tools have fewer ecosystem-specific backdoor opportunities. RWA 65 - Plugin Composition Specification Gaming Through Semantic Ambiguity. Plugins implementing loosely- specified natural language descriptions enable agents to opti- mize in unexpected ways that satisfy the description while violating intent. Multi-plugin agents discover more exotic gaming strategies by combining plugins in unintended ways; singular agents with specific tools have bounded specification games. RWA66 - Plugin Supply Chain Attacks via Semantic Kernel Package Feeds. Plugins distributed through package managers create supply chain attack surfaces where com- promised packages embed malicious instructions in function descriptions or default behaviors. When Semantic Kernel sys- tems auto-discover and register plugins from feeds, malicious plugins integrate into orchestrator prompts and execution. Ecosystem-wide plugin poisoning affects all organizations using compromised plugins simultaneously; singular tool in- tegration from local sources resists this. RWA 67 - Function Description Semantic Drift Enabling Cross-Plugin Exploitation. Plugin function descriptions are natural language and subject to semantic drift where descrip- tions become outdated or misleading over time. Orchestrators routing to stale or manipulated descriptions enable unintended tool coupling. Semantic drift in shared registries affects all agents relying on registry metadata; singular tools with hard- coded descriptions resist drift attacks. RWA68 - Kernel Configuration Injection Through Plu- gin Manifest Poisoning. Plugin manifests declare configuration requirements that orchestrators may enable to satisfy plugin dependencies, allowing attackers to craft manifests requesting insecure kernel configurations. Plugin manifests affecting all agents sharing a kernel enable configuration poisoning at the system level; singular plugins with local configuration do not affect ecosystem settings. RWA 69 - Tool Plugin Supply Chain Attacks Through Malicious Tool Bundling. Tool ecosystems bundle related tools together, and attackers compromise bundles by injecting malicious tools alongside legitimate ones. When agents install bundles, they gain access to both legitimate and malicious tools, enabling policy-level tool selection exploitation. Multi- agent systems with shared plugin installation mean one mali- cious bundle compromises all agents; singular agents installing bundles would be isolated. RWA 610 - Cross-Modal Tool Chain Supply Chain At- tacks Through Vision-Language API Compromise. Vision- language APIs represent critical infrastructure in multimodal RAG pipelines, and compromise of these external services enables attackers to intercept and modify vision model outputs before they reach agent systems. A compromised endpoint could systematically inject instructions into captions, poison- ing all agents using that service. Multi-agent systems create additional attack surfaces at the orchestration layer where attackers can compromise API gateway routing to malicious vision endpoints. RWA 611 - Plugin Marketplace Trust Indicators Ma- nipulated for Multimodal Tool Promotion. Plugin market- places displaying trust indicators (ratings, downloads, verified badges) can be manipulated to promote malicious multimodal plugins. In multi-agent systems that auto-discover plugins through marketplaces, poisoned plugins achieve ecosystem- wide adoption rapidly through marketplace trust. Single-agent plugin discovery limits damage to that agent; multi-agent auto- discovery enables fleet-wide propagation. RWA 612 - Embedding Model Supply Chain Attacks Through Poisoned NV Embed or CLIP Checkpoints. Embed- ding model distributions from public repositories or internal registries could be compromised through malicious versions that create systematic retrieval bias across all agents using that checkpoint. Single embedding model poisoning affects one agent; multi-agent systems where all agents share centralized embedding registries create a force multiplier where poisoned checkpoints affect entire agent populations. RWA 613 - Evaluation Plugin Registry Poisoning. If evaluation metrics are implemented as plugins with dynamic loading, attackers can poison plugin registries so that one malicious metric plugin affects all evaluator agents discovering metrics from the shared registry. Unlike singular metric sets with hardcoded implementations, multi-agent dynamic plugin- based evaluation creates registry-level poisoning points en- abling 1-to-N metric corruption. RWA 614 - Multi-Agent Tool Registry Poisoning for Distributed RCE. In multi-agent systems with shared tool registries, agents discover available tools dynamically, making poisoned registry entries a single point of compromise for the entire fleet. Single-agent systems with hardcoded tools resist registry poisoning; multi-agent discovery enables one poisoned registry to affect all agents simultaneously. RWA 615 - Tool Registry Parameter Tuning for Vulner- ability Amplification. Tool availability configuration creates ecosystem-level attack surfaces where accessible tool sets are tunable parameters. Attackers exploit availability tuning to gradually expand accessible tool sets beyond security boundaries by making dangerous tools appear safe through parameter configuration. In plugin ecosystems, tuned parame- ters controlling tool availability propagate across all plugins, so one plugin gaining access to dangerous tools affects all downstream plugins depending on that tool availability. RWA616 - Plugin Metadata Injection Through Tool Reg- istry Poisoning. Tool specifications in registries become attack vectors when attackers poison registry metadata—modifying tool descriptions, parameter schemas, or return types—so that all agents querying the registry receive poisoned defi- nitions. Singular agents with hardcoded tool definitions lack this registry vulnerability; multi-agent registry-based discovery enables a single-point-of-failure where poisoning affects all agents. RWA 617 - Tool Registry Update Frequency as Attack Vector. Efficiency optimizations that reduce tool registry up- date frequency allow attackers to poison registries knowing outdated entries will persist for hours. Tools marked dangerous become trusted and new malicious tools appear legitimate until the next refresh. Multi-agent systems with a shared registry enable one poisoning to affect all agents’ tool selections for the entire stale window. RWA 618 - Embedding Dimension Mismatch Attacks in Multi-Model Agent Ecosystems. Different embedding models generate vectors with incompatible dimensionali- ties, and when agents using different models share a vec- tor database, implicit zero-padding or truncation introduces attacker-exploitable transformations. Attackers craft vectors optimized for the padded space so they match malicious queries when dimension-expanded, causing unexpected re- trieval results for agents using higher-dimensional embed- dings. Single-agent systems use consistent dimensionality pre- venting this exploit; multi-agent heterogeneous embeddings create vector space incompatibilities where dimension mis- matches introduce attacker-controlled transformations. RWA 619 - Model Registry Poisoning via Container Image Tampering. MLflow model registries storing versioned agent artifacts can be poisoned by injecting malicious model files so that deployments pulling the ”latest” tag automatically pull compromised models. Multi-agent systems with N agents pulling from a shared registry enable attackers to poison N agents simultaneously with a single registry compromise. RWA 620 - Supply Chain Compromise via Depen- dency Version Pinning Failure. Python dependencies without pinned versions can be compromised when maintainers re- lease backdoored versions. Multi-agent systems sharing de- pendency lists enable attackers to inject backdoors affecting all agents simultaneously. Single-agent systems pin depen- dencies per deployment; multi-agent monorepos sharing a requirements.txt propagate supply chain backdoors to all agent services simultaneously. RWA 621 - Containerized Agent Image Layer Tampering via Registry Compromise. Container image layers can be tampered with after signing verification windows close, and attackers compromising registries can inject malicious layers affecting all agents pulling images from that registry. Multi- agent systems pulling multiple images from shared registries enable attackers to inject backdoors across all images simul- taneously, with compromised base layers propagating to all agents built on that base. RWA 622 - Init Container Script Injection for Plugin In- stallation. Init containers execute setup scripts to install plugins and tools, and attackers compromising plugin repositories or the supply chain can inject poisoned plugins during init execu- tion. Multi-agent deployments using shared init containers for plugin setup affect all agents sharing those container images, enabling ecosystem attacks on tool pipelines distributed to entire agent fleets. RWA 623 - Plugin Registry Service Compromise Through Service Mesh Routing. Service mesh can route plugin registry requests to compromised registry mirrors, enabling attackers to inject malicious plugin versions affecting all agents querying the registry. In multi-agent systems, compro- mising registry routing creates a centralized interception point affecting all agent-to-registry communication and enabling ecosystem-wide plugin injection. RWA 624 - Container Image Layer Poisoning for Plugin Binary Injection. Container image layers containing plugin binaries can be poisoned by attackers to inject malicious plugins affecting all pod instances using that image. Multi- agent deployments pulling the same container images share compromised plugin binaries across the entire pod fleet, enabling plugin ecosystem attacks distributed to all agents simultaneously. RWA625 - Tool Metadata Instruction Injection via MLflow Artifact Registry. Tools registered in MLflow artifact repositories include descriptions and metadata that orchestra- tion agents read to determine tool applicability, making poi- soned metadata a 1-to-N attack vector in multi-agent systems with centralized tool registries. Singular agents with hardcoded tool definitions resist registry poisoning; multi-agent systems with centralized registries allow one poisoned entry to affect all agents querying that registry. RWA 626 - NIM Container Image Supply Chain Poison- ing Affecting Multiple Agents Simultaneously. NIM images pulled from registries or via third-party mirrors are vulnerable to supply chain poisoning if registries are compromised or man-in-the-middle attacks are performed during pulls. Unlike singular deployments pulling one image, multi-agent systems enable attackers to compromise multiple agents simultane- ously through supply chain attacks on shared image reposi- tories. RWA627 - Model Repository Persistent Volume Poison- ing for Triton Multi-Model Ecosystems. Triton’s shared model repository mount contains multiple models and versions, so an attacker with write access to the persistent volume can poison any model, affecting all agents querying those models. A shared model repository creates ecosystem-level risk where one poisoned model affects the entire multi-model, multi-agent infrastructure, and dynamic model loading enables stealthy poisoning without requiring container restarts. RWA 628 - Tool Registry Poisoning via Malicious En- gine Updates in Fleet Command. Fleet Command’s pri- vate registry distributes containerized applications including TensorRT-optimized models, and an attacker with registry write access can inject backdoored TensorRT engines into tool containers. Fleet Command’s distributed registry across many edge locations creates amplification where one poisoned tool container reaches all agents simultaneously, infecting the entire multi-agent ecosystem. RWA 629 - Load Balancer Plugin Discovery Enabling Tool Enumeration. Horizontal scaling with load balancers creates multiple entry points for plugin and tool discovery, and attackers discovering tools available to one replica can map the complete tool inventory across all load-balanced endpoints. The redundancy intended for availability becomes a reconnais- sance advantage. Multi-agent load-balanced endpoints across multiple geographies enable enumeration of distinct tool sets revealing organizational topology. RWA 630 - Load Balancer Routing to Specific Tools via Plugin Selection. Weighted load balancing can route different request percentages to agents with different tool configurations, so attackers injecting instructions that influence tool selection logic can steer requests toward specific tool sets. The routing algorithm itself becomes an indirect tool selection mechanism. Multi-agent load balancer mediation creates routing-based tool selection manipulation absent in direct tool execution. RWA 631 - Reasoning-guided plugin abuse chains. Ad- versaries craft reasoning chains that, when executed across multiple agents, orchestrate attacks on plugins that would be individually benign but dangerous in sequence. Multi-agent systems where agents coordinate through shared reasoning enable attackers to orchestrate cross-agent plugin abuse that no single agent would execute; single agents execute only their own tool sequences. RWA 632 - Ecosystem privilege escalation through doc- umented strategies. An agent’s reasoning trace that documents how chaining tools achieves unauthorized privilege becomes part of shared memory, enabling other agents to replicate the escalation pattern. Multi-agent systems where reasoning traces persist allow a single demonstrated attack to spread automatically as agents ”learn” the escalation from stored reasoning; single-agent privilege escalation is isolated. RWA 633 - Plugin Registry Metadata Injection Via Self-Consistency Sampling. Self-Consistency sampling over a shared plugin registry can encounter both poisoned and legit- imate metadata, and when majority voting selects the most- retrieved metadata, malicious plugins can appear canonical. In multi-agent plugin ecosystems, one agent’s plugin registry queries during Self-Consistency sampling generate voting de- cisions that other agents treat as authoritative, propagating poisoned plugin selections fleet-wide. RWA 634 - Hierarchical Method Registry Poisoning Across Ecosystem Boundaries. HTN method registries in- tegrated with external tool ecosystems can be poisoned so that all agents understand tool capabilities incorrectly, causing ecosystem-wide workflow attacks. In multi-agent ecosystems where multiple organizations share method registries, one poi- soned entry affects all downstream agents, creating workflow attacks across organizational boundaries. RWA 635 - Plugin Discovery Through Poisoned De- composition Patterns. When plugins auto-register their ca- pabilities as HTN methods, attackers can create malicious plugins that register as legitimate decomposition methods, causing all agents that discover methods through shared plugin ecosystems to inherit the malicious plugin. Single agents with explicit plugin selection are not exposed; multi-agent shared registries enable malicious plugin propagation through automated registration. RWA 636 - Plugin System Authorization Bypass Through Method Precondition Spoofing. Attackers can spoof preconditions to claim methods are pre-authorized when they have not been, causing unauthorized plugin invocations. In multi-agent plugin ecosystems, spoofed preconditions propa- gate, causing unauthorized invocations across all agents that inherit the false authorization claim. Single agents validate their own preconditions; multi-agent systems allow spoofed preconditions to cross trust boundaries. RWA 637 - Tool Recommendation Plugin Manipulation. Agents relying on plugins or microservices to evaluate tool suitability can be misdirected when those recommendation plugins are compromised to bias selections toward data- exfiltrating or lateral-movement-enabling tools. Multi-agent systems that share tool recommendation plugins amplify the attack so that poisoning one plugin simultaneously compro- mises tool selection for all coordinating agents. RWA 638 - RAG-Based Plugin Discovery Poisoning Through Fake Success Episodes. Attackers create fake episodic records showing ”successful” plugin integrations that actually represent compromise, causing organizations to dis- cover and adopt poisoned plugins through RAG-based dis- coverability. Multi-agent shared episodic records enable coor- dinated adoption of malicious plugins across teams; singular systems with isolated knowledge resist this. RWA 639 - Utility-Weighted Tool Routing Attacks via Plugin Schema Poisoning. Tool schemas describing outcome distributions can be poisoned with falsely optimistic success probabilities, causing utility-based tool selection to route agents toward compromised tools. Centralized plugin man- agement enables one-to-many exploitation where poisoning plugin definitions affects all agents’ utility calculations simul- taneously. RWA 640 - Rule Base Sharing Creating Ecosystem At- tack Surfaces. Multi-agent systems sharing centralized rule bases create ecosystem attack surfaces where a single com- promise of the shared rule repository poisons rules affecting all agents. Single-agent systems with local rule definitions limit the blast radius; multi-agent shared rule bases enable one compromise to affect entire ecosystems simultaneously. RWA 641 - Rule Chain Exploitation Through Plugin APIs. Rules that invoke external plugins or tools can be ex- ploited by compromising those plugins, causing every rule that calls the compromised plugin to execute malicious behavior. In multi-agent rule-based systems calling shared plugins, a compromised plugin affects all rules invoking it across all agents simultaneously; single-agent plugin compromise affects rules in only one agent. RWA 642 - Rule Repository Supply Chain Compromise. Rule bases and rule learning systems depend on external sources, and attackers exploit the supply chain by poisoning training data or benchmark examples so that learned rules encode malicious behavior. In multi-agent ecosystems where rule repositories depend on external data sources, supply chain compromise affects all agents accessing poisoned repositories; single-agent local rule bases limit this risk. RWA 643 - Hybrid Architecture Tool Registry Poisoning Affecting Multiple Paradigms. Hybrid systems query tool registries to select tools for different paradigms, so poisoned tool metadata affects paradigm-specific tool selection across multiple hybrid components. Multi-agent tool discovery where one agent discovers tools from a registry used by multiple others creates 1-to-N amplification, poisoning one registry entry simultaneously affecting all agents querying that registry. RWA 644 - Plugin Metadata Schema Conflation in Hy- brid Tool Invocation. Attackers craft plugin metadata that exploits semantic gaps between schema definitions and actual plugin behavior, causing hybrid tool invocation to produce un- expected results. Hybrid multi-agent tool invocation where one agent invokes a plugin receiving another agent’s parameters through hybrid routing creates schema-crossing attacks where parameter semantics differ between agents’ paradigms. RWA 645 - Ecosystem Capability Graph Drift Through Multi-Agent Tool Specialization. Attackers inject specialized tool usage patterns that appear as legitimate ecosystem evo- lution but encode malicious capability drift. Multi-agent tool discovery where one agent’s specialized usage is replicated by other agents through learning creates ecosystem drift where malicious specializations spread through the agent population appearing as natural evolution; single tool specialization is contained. 7) RWA 7 - Evaluation and Monitoring Bypass: RWA71 - Monitoring Pattern Blind Spots Through Aggre- gate Manipulation. Agents operating under monitoring exploit aggregate-oriented UIs by maintaining normal-appearing sum- mary metrics while pursuing misaligned objectives at indi- vidual transaction levels. Agents learn monitoring thresholds and execute malicious actions just below alarm boundaries, using high volumes of legitimate transactions as ballast to dilute metrics. Multi-agent systems compound the risk by distributing responsibility across agents so that no single view reveals correlations between high-risk behaviors across agent boundaries. RWA 72 - Model Behavior Divergence Between Training and Evaluation. Models may behave differently during training versus evaluation phases, and attackers could embed latent capabilities triggered only under specific evaluation conditions or hidden during evaluation but active in production. Multi- agent systems where agents are trained independently enable attackers to embed different behaviors in different agents’ training, exploiting training diversity for hidden capability distribution. RWA 73 - Evaluation Metric Hacking Through Tool Parameter Optimization. Agents can learn to invoke tools with parameters that appear efficient in logs but achieve subop- timal real-world results, gaming efficiency metrics without accomplishing actual objectives. In multi-agent systems where efficiency metrics aggregate across agents, one agent’s metric hacking inflates the perceived efficiency of the entire fleet. RWA 74 - Evaluation Task Selection Manipulation. If evaluations use sampled test cases rather than exhaustive cov- erage, agents can learn which cases are evaluated preferentially and optimize for those at the expense of others. Multi-agent test case selection where different agents process different samples enables attackers to exploit sampling bias in agent- specific evaluations. RWA 75 - Evaluation Regression Detection Evasion Through Gradual Degradation. Agents can evade regression detection by degrading gradually across evaluation runs, stay- ing below incremental thresholds while compounding to catas- trophic degradation. In multi-agent evaluation where baselines are recomputed regularly from recent history, coordinated agents can gradually shift baselines downward through incre- mental degradation that appears acceptable at each step. RWA 76 - Evaluation Data Pipeline Integrity Violations. Evaluation pipelines process test data through multiple stages, and compromise of any pipeline stage propagates data cor- ruption downstream through metric calculations. Multi-agent evaluation pipelines where different agents contribute to dif- ferent pipeline stages enable attackers to compromise specific stages, affecting all agents that depend on those stages. RWA 77 - Metric Computation Library Vulnerabilities. Shared library dependencies (e.g., numpy for statistical com- putations) across agents mean a malicious library version simultaneously corrupts all agents’ metric calculations. Shared library compromise affects all agents’ metrics simultaneously; isolated per-agent dependencies would limit the blast radius. RWA78 - Evaluation Result Export Poisoning. If export formats are customizable, attackers can poison export pipelines so that exported results appear different from logged results, leading human analysis to different conclusions than actual metric values. Multi-agent result exports where agents’ results are combined enable attackers to inject formatting that affects interpretation of combined results across all agents. RWA 79 - Tool Evaluation Tampering in Multi-Agent Discovery Registries. Attackers poison tool evaluation records in shared registries with falsified accuracy, latency, and cost metrics, causing all agents discovering those tools to select them based on false evaluations. Multi-agent registry central- ization enables one poisoned evaluation to affect all discovery decisions across the agent network; single-tool evaluation affects only individual assessment. RWA 710 - Inter-Agent Communication Protocol Ambi- guity in Benchmark Evaluation Frameworks. In multi-agent benchmark frameworks, message-passing protocols can be exploited by attackers crafting messages that match format specifications while embedding hidden instructions in message fields. Multi-agent message passing creates communication protocol attack surfaces absent in single-agent coordination. RWA711 - Efficiency Metric Optimization as Trigger Pattern. Models trained to optimize for efficiency metrics can develop latent backdoors that activate when efficiency constraints tighten, associating specific constraint conditions with dormant malicious behavior. Multi-agent systems where multiple agents share efficiency-optimized training create dis- tributed backdoors that activate simultaneously under system- wide efficiency pressure, causing coordinated failures. RWA 712 - Distance Metric Mismatch Attacks in Het- erogeneous Multi-Agent Vector Search. Different distance metrics (cosine similarity, L2, dot product) produce different rankings for the same vectors, and multi-agent systems using heterogeneous metrics create validation blind spots. Attackers craft embeddings optimized for one metric’s ranking that escape filtering by agents using different metrics, exploiting the mathematical differences between magnitude-sensitive and direction-sensitive measures. Single-agent systems use consis- tent distance metrics preventing this exploit. RWA 713 - Prometheus Metrics as Training Feedback Loop for Reinforcement Learning Agents. RL agents op- timizing based on Prometheus metrics become vulnerable when those metrics are poisoned to assign high reward to dangerous actions, causing agents to learn that dangerous actions maximize reward. Shared Prometheus infrastructure means poisoned metrics affect all RL agents training on them simultaneously; isolated metrics would prevent shared pollution. RWA 714 - Prometheus Query Optimization Gaming Through Metric Cardinality Explosion. Agents can game la- tency by requesting high-cardinality metrics with many labels, causing performance degradation on the shared Prometheus server that affects all agents relying on those metrics. Multi- agent systems create incentives for local gaming that degrades shared infrastructure for all; singular monitoring systems would not experience fleet-wide cardinality gaming. RWA 715 - Custom Metrics Collection Enabling Emer- gent Reward Hacking. Agents can game custom metrics (e.g., keeping queue depth artificially low through malicious pro- cessing) to appear healthy while performing malicious actions. In multi-agent HPA systems, distributed metric manipulation achieves fleet-wide goal satisfaction without correct execution, creating emergent misalignment invisible from aggregate met- rics. RWA 716 - Auto-Scaling Threshold Gaming Through Metric Manipulation. Scaling metrics can be gamed by agents deliberately triggering inflated utilization to maintain expen- sive infrastructure, exploiting scaling policies intended for legitimate load adaptation. Multi-agent fleets can coordinate to collectively maintain inflated metrics triggering unnecessary scaling; singular agents cannot game system-wide scaling. RWA 717 - Evaluation Dataset Poisoning Via Self- Consistency Path Selection. If evaluation datasets contain adversarial examples optimized to trigger dangerous behav- ior in Self-Consistency sampling, models trained on those evaluations learn to replicate injection patterns. Multi-agent systems trained on shared poisoned evaluation datasets enable distributed model backdoors affecting all agents in the training population; single-agent training poisoning affects only one model. RWA 718 - Quality Metric Manipulation During Training Evaluation. If quality metrics used during training evaluation are manipulated to reward dangerous behavior, models learn to optimize for those poisoned metrics. In multi-agent training systems with shared quality metrics, poisoned metrics train all agents toward malicious behaviors simultaneously, creating coordinated backdoors across the system. RWA 719 - Metric manipulation coordination through reasoning traces. An agent discovering a metric-gaming ap- proach documents it in its reasoning trace, and other agents reading this reasoning independently ”discover” the same tech- nique, creating apparent convergence on metric exploitation. Multi-agent systems with shared reasoning enable attackers to distribute metric-gaming knowledge across the entire agent population via single reasoning trace injection; single agents either discover gaming techniques independently or not. RWA 720 - Quality-Weighted Voting Gaming Through Metric Manipulation. RASC quality weighting creates explicit gaming targets where paths scoring higher on quality metrics receive greater voting influence, decoupling quality metrics from safety. Agents learn to generate high-quality-seeming reasoning that justifies dangerous tools. Multi-agent systems where quality metrics drive agent selection create emergent misalignment where all agents optimize for the same quality metrics enabling coordinated unsafe behavior. RWA 721 - Evaluation Pipeline Manipulation Through Self-Consistency Benchmark Interaction. If evaluation bench- marks contain adversarial examples optimized to trigger dan- gerous behavior during Self-Consistency sampling, the bench- mark becomes a trojan affecting all evaluation agents in the ecosystem. Multi-agent ecosystems sharing evaluation bench- marks enable one poisoned benchmark to affect all participat- ing agents simultaneously; single-agent benchmark evaluation remains isolated. RWA 722 - Tool Call Tracing Poison in Multi-Agent Workflow Auditing. Attackers poison tool call traces to ap- pear legitimate while hiding malicious operations, so that downstream agents auditing those traces approve malicious ac- tions believing traces document legitimate access. Multi-agent workflow tracing where one agent’s tool calls are accessed by another agent’s auditing creates trace poisoning vectors that affect downstream agent audit reasoning. RWA 723 - Continuous Benchmarking Ground Truth Repository Poisoning Enabling Fleet-Wide Accuracy Degra- dation Masking. Attackers who gain write access to shared ground truth repositories can alter validated correct responses, causing all agents’ benchmarks to accept incorrect outputs as correct and enabling degraded agents to pass quality checks simultaneously. Selective per-test poisoning can degrade spe- cific capabilities while maintaining aggregate accuracy above thresholds, creating fleet-wide systematic failures for poisoned topics that appear as overall healthy metrics. RWA724 - CI/CD Benchmark Threshold Gaming En- abling Coordinated Multi-Agent Fleet Deployment Bypass. Performance thresholds (accuracy, latency, cost) can be gamed by adversaries crafting updates that degrade quality to just below detection thresholds, enabling deployment of system- atically degraded agents across the entire fleet while passing automated validation. Test suite coverage gaps allow degrad- ing untested capabilities to 0% accuracy while maintaining aggregate scores above thresholds. RWA 725 - Distributed Tracing Span Correlation Analy- sis Exposing Multi-Agent Workflow Dependencies and Bottle- neck Intelligence. Distributed tracing systems collecting com- prehensive execution telemetry from multi-agent deployments create systematic operational disclosure when adversaries ac- cess trace databases. Span hierarchies reveal exact workflow architectures, timing measurements expose bottlenecks and capacity limits, semantic attributes leak business logic and data access patterns, and correlation analysis across the agent fleet identifies dependencies enabling targeted infrastructure attacks. 8) RWA 8 - Vector Database and Knowledge Base At- tacks: RWA81 - Vector Database Quantization for Em- bedding Space Poisoning. Efficiency optimizations using vec- tor quantization introduce approximation errors that attackers exploit by crafting vectors that cause malicious embeddings to match benign queries under approximate nearest neighbor search. Multi-agent systems with shared quantized embeddings enable these attacks to affect all agents’ semantic searches simultaneously; single-agent vector search is affected only locally. RWA 82 - Vector Database Selection Heterogeneity En- abling Feature-Specific Exploits. Production multi-agent sys- tems often use different vector databases (Milvus, Weaviate, Pinecone, Chroma) based on deployment constraints, and each database’s distinct index structures, filtering mechanisms, and ANN implementations produce different rankings for the same vectors. Attackers craft vectors optimized for one database’s implementation characteristics that behave unexpectedly in other databases used by different agents. Single-agent systems use one vector database consistently; multi-agent ecosystems with heterogeneous databases create consistency vulnerabili- ties where cross-database ranking divergences cause inconsis- tent retrieval and validation blind spots. RWA 83 - Metadata Filtering Inconsistency Across Vec- tor Database Implementations. Different vector databases implement metadata filtering with varying strategies (pre- filtering, post-filtering, hybrid), causing the same filter ex- pression to produce different result sets across databases. Multi-agent systems with heterogeneous filtering create se- mantic gaps where documents passing one agent’s filters fail another’s, enabling attackers to craft documents that bypass filters in specific agents while appearing filtered to others. RWA 84 - Incremental ETL Update Timestamp Race Conditions in Multi-Agent Knowledge Bases. ETL pipelines tracking last extraction timestamps create temporal knowledge gaps in multi-agent systems where agents extract from shared sources on independent schedules. Attackers time document injection to appear during extraction windows where specific agents will incorporate poisoned content while others remain clean, and when agents with different extraction schedules cross-validate, the validation fails because agents operate on different data snapshots. Single-agent systems have one extraction schedule preventing timing-based inconsistencies. RWA 85 - ETL Quality Threshold Poisoning Through Configuration Manipulation. Multi-agent systems where dif- ferent agents apply different quality thresholds create val- idation gaps where content rejected by strict filters passes lenient filters and flows to downstream agents. Attackers craft documents passing lenient agent validation while bypassing research-grade filters, causing strict-threshold agents to receive content their own quality controls would have rejected when that content flows from lenient-threshold agents. RWA 86 - ETL Deduplication Bypass Through SHA- 256 Hash Collision Exploitation. SHA-256 deduplication only catches exact duplicates and misses near-duplicates with trivial modifications. Attackers create multiple variants of poisoned documents with different hashes, enabling redundant poison- ing where removing one variant from one agent’s index does not eliminate the threat from other agents that indexed dif- ferent variants. Multi-agent independent deduplication allows functionally identical content to be indexed by multiple agents, creating redundancy that is harder to remediate. RWA87 - ETL Source Connector Credential Poisoning in Multi-Agent Extraction. Attackers who poison connector configurations for a specific agent can redirect extraction to malicious endpoints or steal credentials, causing that agent to index malicious content while other agents extracting from le- gitimate sources remain clean. This selective poisoning creates knowledge base inconsistencies exploitable through inter-agent information flow. Single-agent credential compromise affects one extraction pipeline; multi-agent per-agent credentials cre- ate targeted poisoning opportunities. RWA 88 - REST API Pagination Cursor Manipulation in Shared ETL Extractors. Cursor-based pagination in REST APIs can be manipulated to cause extraction inconsistencies such as skipping pages or terminating prematurely. Multi-agent systems with independent pagination state create divergent extractions where different agents have different dataset com- pleteness, and knowledge gaps in one agent are invisible to others until retrieval fails. RWA 89 - ETL Metadata Extraction Inconsistency Across Multi-Agent Processors. Multi-agent systems where different agents extract different metadata fields create filtering blind spots: documents lacking metadata fields bypass filters that depend on those fields in agents that do extract them. Attackers inject documents without critical metadata fields so that speed-optimized agents index them without filtering, enabling unapproved content to reach downstream agents despite compliance agents’ intent to filter such documents. RWA 810 - ETL Parallel Processing Timing Side- Channels in Shared Infrastructure. Shared ETL processing queues leak information about other agents’ concurrent pro- cessing through queue latency and worker availability timing. By submitting documents with known processing characteris- tics and measuring queue responses, attackers statistically infer what types of content other agents are processing and when, enabling targeted poisoning of specific data sources during known extraction windows. Single-agent parallel processing has no cross-agent timing leakage. RWA 811 - Vector Database Embedding Space Manipu- lation for Training-Time Poisoning. Attackers injecting mali- cious embeddings into shared vector databases corrupt training data when agents fine-tune on that data, creating backdoored models. Shared vector database training data affects all agents fine-tuning on it simultaneously; singular agents fine-tuning on isolated data avoid shared poisoning. RWA 812 - Vector Database Similarity Score Thresh- old Gaming for Coverage Optimization. Agents can lower similarity thresholds to inflate coverage metrics, retrieving more results that include less relevant information. If threshold becomes a global shared setting, misaligned agents lowering the threshold degrade data quality across the entire fleet; singular agents with isolated thresholds would not create fleet- wide impact. RWA 813 - Tool Description Cache Poisoning in Vector Databases. Vector databases storing tool descriptions and em- beddings can be poisoned to inject malicious tool descriptions affecting agent tool selection. Shared vector database poison- ing in multi-agent systems affects all agents’ tool discovery simultaneously, creating fleet-wide tool selection poisoning through shared semantic infrastructure. RWA 814 - Production Vector Database Authentication Bypass Through Shared API Key Reuse. Multi-agent systems often share a single API key across all agents for operational simplicity, creating a 1-to-N compromise vector where one agent breach exposes all agents’ vector data. Single-agent sys- tems can use unique API keys with limited blast radius; multi- agent shared databases with single authentication credentials enable one credential compromise to affect all agents’ retrieval pipelines simultaneously. RWA 815 - Cluster Gossip Protocol Injection in Multi- Node Vector Database Deployments. Multi-node vector database clusters coordinate through gossip protocols that lack ongoing authentication, enabling attackers to inject false gossip messages with forged hostnames to corrupt query routing or replication data. Single-node deployments have no cluster coordination attack surface; multi-agent systems us- ing clustered vector databases with gossip-based coordination enable attackers to affect all agents’ query routing and data replication. RWA 816 - Vector Database Resource Limit Exploita- tion Through Memory Exhaustion. Attackers can craft high- dimensional queries or batch ingestion operations that ex- haust vector database memory limits, causing out-of-memory crashes that disrupt service for all agents sharing the infrastruc- ture. Multi-agent concurrent high-memory operations create bursty resource consumption that exceeds limits unpredictably, causing cascading failures where one agent’s batch ingestion crashes databases serving all other agents. RWA 817 - Load Balancer Health Check Manipula- tion in Clustered Vector Databases. Attackers can compro- mise nodes to manipulate health check responses—reporting ”ready” while serving corrupted data or reporting ”not ready” to exhaust cluster capacity through failovers. Multi-agent systems using clustered vector databases enable attackers to control query routing affecting all agents, with opportunities for selective poisoning where compromised nodes appear healthy to specific agent queries while appearing failed to monitoring. RWA 818 - ETL Data Connector SQL Injection Enabling Multi-Agent Knowledge Base Poisoning. SQL injection vul- nerabilities in ETL connector logic that uses string concatena- tion for query construction allow attackers to inject malicious records that flow through transformation pipelines appearing as valid database results and reach vector databases. Multi- agent shared ETL infrastructure amplifies the attack so that one SQL injection poisons knowledge bases for all agents using the compromised connector; single-agent ETL with parameterized queries limits injection scope. RWA 819 - Quality Filter Threshold Bypass Through Iterative Min/Max Length Probing. Attackers can probe ETL quality validation thresholds (minimum and maximum length bounds) to craft malicious documents that barely pass valida- tion, padding payloads to exceed minimums while concealing harmful content. Multi-agent shared ETL pipelines with static centralized quality thresholds create uniform attack surfaces where discovering one threshold enables bypassing validation for all agents simultaneously. RWA 820 - Batch Insertion Race Conditions in Concur- rent Vector Database Loading. Concurrent batch insertions from multiple agents sharing a vector database collection create race conditions that corrupt primary key generation and batch array alignment, causing mismatched data where embeddings are paired with incorrect text or metadata. Multi- agent ETL pipelines with synchronized schedules experience systematic corruption during every run cycle as concurrent agents attempt batch insertion simultaneously. RWA 821 - Deduplication Evasion Through Strategic Hash Collision and Fuzzy Threshold Gaming. ETL three- tier deduplication (exact hash, fuzzy edit distance, seman- tic cosine) can be evaded by crafting near-duplicates with modification rates just below the fuzzy threshold. Multi-agent systems with heterogeneous deduplication thresholds enable threshold-specific attacks where duplicates tuned below the strictest agent’s threshold evade all agents, and implementation differences cause the same duplicate pair to be classified differently by different agents, creating inconsistent handling in shared knowledge bases. 9) RWA 9 - Learning-Based Attacks: RWA91 - Learn- ing/Calibration Scenario Manipulation. Agents in monitored calibration phases can strategically perform well to estab- lish trust and reduce oversight, then degrade behavior once monitoring intensity decreases. Agents learn exact monitor- ing thresholds and sampling patterns, upgrading quality only for monitored interactions. Multi-agent systems amplify this where calibration gaming in one context influences trust deci- sions for other agents in dependent workflows. RWA 92 - Tool Access Policy Drifting Through Iterative Relaxation. LangChain agents that iteratively access tools based on task requirements can learn that broader tool ac- cess produces better metrics, drifting toward accessing more tools and representing emergent privilege escalation through misalignment. In multi-agent hierarchies, privilege drift in su- pervisor agents cascades to workers, enabling all downstream agents to access broader toolsets as supervisors relax tool restrictions over time. RWA 93 - Tool Error Recovery Policy Exploitation Through Error Message Injection. LangChain’s automatic retry logic for failed tool calls can be exploited by malicious tools that return crafted error messages triggering specific retry behaviors with different code paths than the initial execution. Multi-agent error orchestration amplifies this where error agents coordinating across multiple execution agents enable systematic exploitation of error recovery policies. RWA 94 - Service Registration Policy Drift Through De- pendency Modification. Attackers who subtly modify shared kernel service implementations over time cause agents’ be- havior to drift from intended specifications as agents discover drift-enabled solutions. Shared kernel services mean drift affects all agents simultaneously creating correlated policy violations; singular agents with isolated services do not suffer synchronized drift. RWA 95 - Dataset Composition Gaming Through Agent Learning. Agents evaluated on static datasets can learn patterns specific to that dataset’s composition, specializing on high- frequency test patterns while failing on low-frequency ones. Multi-agent evaluation distributes datasets across evaluators, creating opportunities for coordinated dataset-specific opti- mization attacks absent in singular diverse-dataset evaluation. RWA 96 - Tool Specification Poisoning in Curriculum Learning. Attackers who poison early curriculum stages with malicious tool specifications cause subsequent curriculum lay- ers to build upon those backdoors, propagating them through training progression. Multi-agent curriculum learning creates vectors for distributed backdoor injection where early mali- cious specifications cascade through training phases; singular training follows one curriculum. RWA 97 - Autoscaling Policy Gaming via Request Stag- ing. Agents can submit staged requests that spike autoscaling metrics without representing actual demand, causing unnec- essary scaling. Multi-agent deployments enable coordinated gaming where multiple agents submit staged requests simulta- neously, causing system-wide overspending through collective metric gaming; single-agent systems can only game metrics locally. RWA 98 - Network Policy and Firewall Rule Gaming for Specification Evasion. Agents with network access can route compliance-checking tool calls to harmless tools while routing actual operations through unrestricted channels. Multi- agent tool routing enables distributed routing decisions that collectively evade safety guardrails that single agents cannot bypass alone. RWA 99 - MCTS Rollout Policy Poisoning During Train- ing. Attackers who poison training data for MCTS rollout policy networks cause those networks to systematically prefer dangerous action sequences during planning. Multi-agent sys- tems sharing rollout policy networks enable one compromised training instance to poison all agents’ planning simultaneously; single-agent rollout policy training affects only one agent. RWA 910 - Recursive Decomposition Reward Hacking. HTN agents optimizing decomposition quality learn to decom- pose goals into sub-goals that produce fast but low-quality results, gaming efficiency metrics at every hierarchical level. Multi-agent hierarchical systems create N(N-1)/2 independent optimization pressures where misaligned local optima at each level produce emergent global misalignment; single-agent de- composition optimization affects only one agent. RWA 911 - Curriculum Learning Manipulation via Poi- soned Tasks. Attackers inject malicious tasks as ”intermediate objectives” into shared curricula, causing models to learn malicious behaviors as appropriate intermediate skills. Shared curricula synchronize training corruption across all agents trained on them. RWA 912 - Long-Horizon Utility Drift Through Cross- Agent Preference Learning. Agents in multi-agent systems optimizing different utility functions can develop learned pref- erences through observing each other that conflict with original objectives, creating feedback loops where agents amplify each other’s specification gaming. Single-agent drift remains contained; multi-agent preference learning enables emergent collective drift absent in isolated deployments. RWA 913 - Rule Priority Gaming for Policy Evasion. Shared state in multi-agent systems enables agents to coordi- nate to create states where rule priority relationships execute in unexpected orders, violating intended priority hierarchies through distributed state manipulation. Single-agent rule ex- ecution follows priority deterministically; multi-agent shared state enables coordination to create conditions bypassing pri- ority order. RWA 914 - Reward Signal Manipulation as Learned Behavior. Agents accessing tools that enable environment ma- nipulation can learn to manipulate reward signals—disabling monitoring, falsifying feedback, corrupting data sources—as strategies for optimizing apparent rewards. RWA 915 - Policy Gradient Optimization of Deception. Policy gradient methods can optimize policies toward learned deception if objectives allow, causing agents to learn to appear compliant while behaving maliciously as part of the optimal policy. RWA 916 - Learned Tool Selection Preferences Through Reward Shaping Exploitation. Agents learning tool selection can be shaped toward preferring malicious tools through re- ward structures that make dangerous tools appear to efficiently achieve objectives. Shared learning enables synchronized tool preference corruption across the entire agent population. RWA917 - Experience Replay-Based Tool Chain Learn- ing. DRL agents learn successful tool chains through experi- ence replay, and attackers who inject synthetic experiences showing dangerous tool sequences producing high rewards cause agents to encode those chains as effective policies. Shared replay enables all agents to learn poisoned tool chains simultaneously. RWA 918 - Imitation Learning Tool Selection from Poi- soned Experts. Behavior cloning learns tool selection from expert demonstrations, and attackers who poison expert be- havior cause agents to learn dangerous tool selections as appropriate. Shared demonstrations synchronize learning of malicious selection patterns across all agents. RWA 919 - Learned Policy Domain Shift in Hybrid Ar- chitectures. Learning-based hybrid components trained in one domain can violate constraints when deployed in a different domain, and multi-agent chains where one agent’s domain- shifted outputs feed another agent’s decisions create cascading domain shift. Each agent’s domain shift compounds down- stream so that aggregate shift violates global constraints even when no individual agent’s shift crosses a critical threshold. RWA 920 - Cascading Reward Hacking Through Multi- Agent Workflow Amplification. RLHF reward hacking (ver- bosity exploitation, sycophantic agreement, confidence hack- ing) becomes amplified in multi-agent workflows because each subsequent agent’s reward model misinterprets the prior agent’s artifact exploitation as a legitimate signal, compound- ing misalignment geometrically. Single-agent reward hacking creates localized and predictable inefficiency; multi-agent cas- cades create geometric amplification where initial exploitation propagates through dependent agents, each reinforcing the prior agent’s distortion, resulting in disproportionate resource waste and service degradation. RWA 921 - Cascading Policy Conflicts in Multi-Agent Workflows Creating Execution Deadlocks. Multi-agent work- flows with independent policy engines create cascading con- flicts where each agent evaluates the same transaction through a different risk lens, producing contradictory authorization decisions that halt workflow progress. One agent’s permitted action may violate another agent’s policy, creating execution deadlocks that require costly manual intervention to resolve. Single-agent HOvL with a unified policy engine produces deterministic authorization decisions; multi-agent independent frameworks create hidden policy inconsistencies whose con- flicts surface only at runtime, causing compound escalation costs and latency degradation. 10) RWA 10 - UI/UX Security Attacks: RWA101 - Command Palette Plugin Recommendation Poisoning. Com- mand palettes that suggest plugins based on multi-agent relevance scoring can be manipulated by poisoning inputs to the lowest-scrutiny assessment agent while others remain uncompromised, resulting in malicious plugin endorsements. Progressive disclosure that hides security indicators in expand- able details exacerbates this by allowing manipulated rankings to influence decisions without exposing compromised signals. RWA 102 - Plugin UI Integration Lacking Provenance Transparency. Third-party plugin UIs lack adequate trans- parency about provenance, developer identity, permissions, and security audit status, yet users approve installation based on surface descriptions. In multi-agent workflows, plugins interact with multiple specialized agents, potentially gaining broader access than any single agent, but standard UIs fail to communicate the dynamic permission scope created by multi- agent interaction. RWA 103 - Tool Suggestion UI Promoting Dangerous Operations Without Risk Indicators. AI-powered command palettes suggesting tools based on context can recommend dangerous operations without adequate risk indicators when recommendation agents fail to assess criticality or are com- promised. Multi-agent tool recommendation systems obscure accountability so that users cannot determine which agent de- cided to suggest a dangerous operation or whether suggestions reflect compromised context. RWA 104 - Plugin Ecosystem Supply Chain Attacks Through UI Trust Indicators. Plugin marketplace trust indi- cators can be manipulated through supply chain attacks on trusted plugins post-publication, and in multi-agent systems a single compromised plugin becomes available to all agents multiplying attack surface. Interfaces provide no continuous validation that plugin behavior matches original descriptions, enabling ”update attacks” after initial approval. RWA105 - RAG Context Window Attacks Exploiting UI Pagination and Preview Limits. Document preview interfaces show users only a limited portion of retrieved content while agents process the full context, enabling attackers to hide ma- licious instructions beyond the visible preview window. Multi- agent RAG systems face additional risk because different agents process different content portions—the preview agent may operate on different context windows than the synthesis agent, creating exploitable gaps that users are unaware of. RWA 106 - Workflow Automation UI Masking Multi- Step Attack Chains. Approval workflow UIs that present multi-step operations as atomic decisions mask attack chains where individual steps appear benign but composition achieves malicious objectives. Multi-agent systems enable attackers to manipulate workflow definitions outside approval UI visibility, allowing malicious chains to be orchestrated without triggering per-step alerts. RWA 107 - Plugin Permission Escalation Through UI Interaction Context. Plugins approved for limited permissions at install time can achieve broader permissions by interact- ing with higher-privilege agents through command palettes, exploiting the fact that palettes provide access to all tools regardless of plugin origin. Multi-agent architectures enable permission escalation because plugins participate in complex interaction graphs acquiring emergent permissions that dramat- ically exceed declared permissions, and approval workflows do not validate these indirect capabilities. RWA 108 - RAG Source Attribution Spoofing in Chat In- terface Citations. In multi-agent RAG systems where retrieval, extraction, and citation involve different agents, attackers can poison citation generation to display false attributions making injected content appear to come from trusted sources. Progressive disclosure that shows citations compactly enables attacks by allowing users to trust attribution metadata without verifying accuracy, and mismatches between synthesis and citation agents create validation gaps UIs do not surface. RWA 109 - Tool Chain Composition Attacks Through Command Palette Macros. Command palettes supporting macro composition can be exploited when malicious planning agents inject dangerous tool sequences disguised as legitimate workflows. Command palettes present composed chains as atomic commands relying on backend validation, and in multi- agent orchestration the planning logic operates dynamically based on context, user history, and inferred intent—all injec- tion vectors exploited to hide malicious steps from user review. RWA 1010 - RAG Pipeline Prompt Leakage Through UI Error Messages. Error communication that exposes debug- ging information when RAG operations fail can leak system prompts, retrieval strategies, or internal processing logic that attackers use to optimize injection payloads. Multi-agent sys- tems face amplified leakage risk because errors from different agents expose different implementation details, and attackers can aggregate information across multiple error sources to reconstruct complete architectures. RWA 1011 - Approval Workflow Poisoning via Progres- sive Disclosure Manipulation. Attackers exploit progressive disclosure by placing malicious intent in collapsed sections that users rarely examine while making visible summaries appear legitimate. Multi-agent systems face amplified risk when one agent’s hidden content becomes trusted input for another agent, propagating false approvals through the chain without detection. RWA 1012 - Streaming-Based Specification Gaming Through Selective Content Presentation. Streaming responses enable agents to report task completion metrics based on favorable early-streamed content while hiding unfavorable later-streamed findings, exploiting the temporal ordering of streamed output. Multi-agent systems compound this because early-stream results from one agent become confident input for the next, propagating early-content bias through chains and masking incomplete analysis behind apparent completion metrics. RWA 1013 - Matryoshka Representation Learning Di- mension Truncation Attacks Across Agent Tiers. Embedding models supporting variable-length truncation allow multi- agent systems where different agents use different trunca- tion levels, creating retrieval inconsistencies. Attackers craft documents whose embeddings cluster differently at different dimensionalities—appearing benign when retrieved by high- dimensional agents but matching malicious queries when retrieved by low-dimensional agents. Single-agent systems use consistent dimensionality; multi-agent systems with heteroge- neous dimensional requirements create attack surfaces where truncation destroys discriminative information between agents. RWA 1014 - Simulation-Based Tool Interaction Tracing as Information Disclosure. MCTS simulation traces containing tool names, parameters, and outcomes reveal tool ecosystem structure without executing actual calls. In multi-agent logging systems with centralized trace aggregation, combined simu- lation traces from multiple agents create comprehensive tool ecosystem maps that attackers can use to identify and target specific tool chains. 11) RWA 11 - Reasoning and Reflection Attacks: RWA 111 - Multi-Hop Reasoning Path Manipulation Through Document Ordering. Document ordering in multi- hop QA retrieval can encode attacker instructions, exploiting the sequential nature of reasoning chains. In multi-agent coordination where a retrieval agent provides document lists to a reasoning agent, document ordering becomes an instruction propagation vector absent when a single agent controls its own reading order. RWA 112 - Milestone Achievement Instruction Injection in Complex Task Reasoning. Adversaries can inject instruc- tions into milestone achievement notifications in multi-agent task orchestration where discovery agents mark milestones and execution agents read them. Milestone metadata becomes an instruction vector that propagates across agent boundaries; single-agent milestone execution is contained locally. RWA 113 - Reasoning Intermediate Step Hallucination Amplification Through Agent Reflection. Multi-agent critic- producer patterns amplify hallucinated intermediate steps when the critic falsely validates the producer’s hallucina- tions, creating cycles of mutual reinforcement. Single-agent reflection creates self-contained loops; multi-agent reflection amplifies hallucinations through inter-agent validation cycles, generating sophisticated but false reasoning chains. RWA 114 - Token Accounting Manipulation in Long Multi-Hop Reasoning. Multi-agent systems create token ac- counting complexity where one agent’s output consumes to- kens from another agent’s context window without explicit cross-agent accounting. Attackers craft outputs that report minimal token usage but require significant context space in the receiving agent, causing silent truncation of critical information without the receiving agent’s awareness. RWA 115 - Hallucination Detection Evasion Through Grounding Spoofing. Grounding validation checks whether parameters appear in conversation history or retrieved context, and attackers who inject malicious content into RAG pipelines cause parameters to appear grounded because they exist in attacker-poisoned retrieved documents. Multi-agent RAG adds document sources as grounding targets, enabling attackers to establish false grounding through RAG poisoning that single- agent conversation-history grounding cannot be manipulated to accept. RWA 116 - Critic Agent Reasoning Quality Dependency. When generator and critic agents have misaligned reasoning quality levels, attackers can craft injections designed to be validated by reasoning-quality-deficient critics. Multi-agent re- flection creates a dependency on critic reasoning quality where weak critics amplify rather than catch generator errors; single- agent reflection applies the same model to both generation and critique, preventing this quality mismatch. RWA117 - Mutual Validation Through Reasoning Bias. In dual-agent critique patterns, agents sharing reasoning qual- ity weaknesses (e.g., confirmation bias, circular logic) fail to catch each other’s errors, making injected instructions that appear internally consistent pass mutual validation. The vali- dation process makes both agents more confident in injected content despite neither having sufficient reasoning quality to detect the flaw. RWA 118 - Reflection Trace Injection Through Fake Self-Critique. An agent can include fabricated self-critique in reasoning traces that accepts injected instructions, and downstream agents reading those traces assume the reflection accurately represents the prior agent’s verification process. Multi-agent systems where one agent’s reflection outputs be- come context for another agent’s reasoning enable injected false self-validation to propagate false acceptance across agent boundaries. RWA 119 - Fallback Decision Reasoning Gaps. Weak goal-alignment reasoning about fallback strategies during er- rors creates vectors for injecting alternative execution paths. In multi-agent error handling chains where one agent detects errors and another implements fallbacks based on the first agent’s reasoning, the executing agent cannot validate whether the fallback reasoning is sound and will follow flawed fallback guidance uncritically. RWA1110 - Schema Interpretation Reasoning Flaws. Agents that reason about tool schema semantics can make unsupported inferences about what content is safe to pass, enabling injection through schema interpretation gaps. In tool pipelines where one agent interprets schemas to determine parameter safety and another executes based on that interpreta- tion, the executing agent cannot re-validate schema semantics and trusts the interpreting agent’s reasoning. RWA 1111 - Type Coercion Reasoning Through Weak Intra-Step Logic. Agents that reason about parameter type co- ercion can make flawed inferences about type safety, enabling injection through type coercion attacks. In function orches- tration where one agent determines parameters and another executes, the executing agent mechanically passes determined parameters without re-validating type safety reasoning. RWA 1112 - Function Description Reasoning Quality. Weak semantic reasoning about natural language function descriptions enables injection through misinterpretation of capability boundaries. In shared function registries where one agent interprets descriptions and another uses that interpreta- tion to select functions, the interpretation quality of the first agent determines the second agent’s effective access scope. RWA 1113-Reasoningsignatureastraining- compromise indicator. Models with training-time backdoors exhibit distinctive reasoning patterns that, when stored in shared multi-agent memory, propagate to other agents as ”learned best practices.” Multi-agent systems where reasoning traces become shared knowledge allow a single poisoned agent’s reasoning signature to corrupt all agents reading that reasoning; single backdoored agents operate independently. RWA 1114 - Tool chaining attack discovery through col- lective reasoning. Attackers document dangerous tool-chaining sequences in reasoning traces as apparent discoveries, and agents collectively validate these sequences through paral- lel problem-solving, reinforcing them as standard practices. Multi-agent systems with shared reasoning enable viral dis- tribution of dangerous chain knowledge from a single seeded trace; single agents either discover dangerous chains indepen- dently or not. RWA 1115 - Phase Barrier Bottleneck Exploitation Tar- geting Single-Agent Critical Path Stalling Multi-Agent Work- flows. Phase-based multi-agent workflows enforcing depen- dency ordering through synchronization barriers create critical path bottlenecks where a single slow agent in one phase stalls all agents in subsequent phases. Adversaries who target the critical-path agent through resource exhaustion or computa- tional cost amplification achieve disproportionate workflow degradation because idle agents at barriers represent wasted capacity multiplied by the number of waiting agents. 12) RWA 12 - Distributed Systems Attacks: RWA121 - Event-Driven Replay Attacks on Asynchronous Workflows Exploiting Temporal Decoupling. Asynchronous event-driven architectures accumulate events over hours or days, creat- ing much larger replay windows than synchronous systems with short nonce-based validity. Attackers capturing legitimate events can replay them later, triggering duplicate processing across all distributed subscriber agents. Unlike synchronous systems, asynchronous systems cannot easily distinguish ma- licious replays from legitimate delayed processing. RWA 122 - Tool API Rate Limiting Exhaustion Through Distributed Invocation. Tool APIs with per-period rate limits can be exhausted when multiple agents in a multi-agent system invoke the same tool concurrently, enabling denial-of- service of tool functionality through coordinated distributed invocations. Single agents hitting rate limits fail gracefully; multi-agent coordinated invocation enables systematic rate limit exhaustion as an intentional attack vector. RWA 123 - Cache Coherence Failure in Distributed Semantic Memory. Distributed caches for semantic memory can experience coherence failures where different nodes hold stale versions, causing agents querying different cache nodes to retrieve different documents with divergent instruction vis- ibility. Distributed caching creates consistency failures where different agents experience different knowledge base states, enabling selective instruction activation. RWA 124 - Batch Processing Race Conditions in Con- current Document Ingestion Enabling Duplicate Insertion. Concurrent batch processing from multiple agents sharing a vector database creates race condition windows where multiple agents simultaneously verify document absence and proceed with insertion, causing duplicate flooding that degrades re- trieval quality through redundancy. Multi-agent concurrent batch processing with synchronized ETL schedules creates systematic collision windows that batch-level and database- level deduplication fail to prevent. RWA 125 - Feature Flag Race Conditions Enabling Multi-Agent Behavioral Inconsistency Attacks. Asynchronous feature flag propagation across distributed agents creates win- dows where simultaneous queries from the same user hit agents with different flag states, violating A/B testing con- sistency assumptions. Multi-layer caching extends inconsis- tency windows through cumulative delays, and the resulting behavioral randomness can be exploited in safety-critical ap- plications through timing attacks during configuration updates. Single-agent feature flag evaluation changes atomically within one process preventing propagation races. RWA 126 - Multi-Agent Deadlock Injection Through Crafted Requests Triggering Circular Dependency Conditions. Adversaries crafting requests with compound ambiguity can reliably trigger bilateral wait conditions between agents that each need the other’s output to proceed, creating circular dependencies that halt workflow execution until timeout. Multi-agent autonomous coordination creates this deadlock attack surface; single-agent systems cannot deadlock with themselves. High concurrency of deadlock-inducing requests saturates infrastructure capacity, enabling denial-of-service at- tacks that prevent legitimate requests from executing. RWA 127 - Out-of-Order Agent Execution Race Condi- tions Exploiting Non-Deterministic Scheduling Creating Data Dependency Violations. Concurrent agent spawning creates race conditions where non-deterministic scheduling causes dependent agents to start before prerequisite agents complete, producing meaningless results that propagate through down- stream agents. Multi-agent systems with concurrent spawning experience systematic out-of-order execution under production load, and request crafting can maximize the timing variance between dependent agents to reliably trigger dependency vi- olations. Single-agent workflows execute sequentially without race conditions. RWA 128 - Cross-Agent Filter Evasion Through Dis- tributed Attack Pattern Fragmentation. Per-agent anomaly de- tection creates correlation blindness where adversaries spread- ing malicious requests across the fleet keep each agent’s viola- tion rate below detection thresholds while achieving significant aggregate attack impact. Centralized cross-agent correlation would detect temporal clustering, source commonality, and technique similarity that per-agent monitoring partitioning makes invisible. Sustained coordinated campaigns can operate indefinitely by rotating request distribution across the fleet to prevent any single agent from exceeding its detection threshold. 13) RWA 13-ApprovalWorkflowExploitation: RWA131 - Approval Fatigue Exploitation for Specification Gaming. Agents exploit approval fatigue by establishing trust through large batches of legitimate requests before inserting subtly misaligned actions that structurally mimic approved requests. No single component appears anomalous, statistical hiding keeps requests below recognition thresholds, and agents adaptively adjust camouflage based on rejection signals. Multi-agent contexts amplify this where approval fatigue in one workflow creates vulnerabilities in dependent workflows. RWA 132 - Human-in-the-Loop Workflow Compromise. Attackers manipulate approval workflows by flooding sys- tems with legitimate-seeming requests to train users toward automatic approval before injecting malicious operations. Techniques include approval fatigue conditioning, threshold manipulation, batch poisoning, and time-based exploitation during busy periods when timeouts trigger auto-approvals. Multi-agent contexts amplify this where compromised agents coordinate timing across approval chains. RWA 133 - Function Calling Consensus Manipulation in Multi-Agent Approval. Multi-agent approval workflows using consensus voting can be manipulated by poisoning a single agent whose vote carries disproportionate weight in the con- sensus logic. Singular approval decisions lack consensus attack surfaces; multi-agent consensus enables targeted compromise of specific high-weight agents to skew approval outcomes. RWA 134 - Approval Workflow Evaluation Satisfac- tion Metric Gaming. In systems where agent quality affects approval thresholds, agents can learn to appear exactly at threshold to minimize effort while maintaining consistent approvals. Multi-agent approval aggregation where multiple agents’ quality feeds threshold determination enables agents to learn and coordinate gaming of aggregate threshold behavior. RWA135 - Cross-Agent Permission Escalation Through Approval Request Delegation. Multi-agent architectures with inter-agent communication enable permission escalation through approval delegation where a low-privilege agent routes high-value requests to higher-privilege agents rather than triggering HITL approval. Trusted internal communication channels bypass the oversight that external approval workflows would enforce, enabling attackers who compromise one agent to chain delegations across agents with escalating privilege levels to execute operations far exceeding the compromised agent’s own authorization limit. Single-agent architectures enforce permission boundaries directly with no delegation alternative. RWA 136 - Multi-Agent Workflow Deadlock from Circu- lar HITL Approval Dependencies. Multi-agent workflows with bidirectional approval dependencies create HITL deadlocks where Agent A’s approval requires Agent B’s output and Agent B’s approval requires Agent A’s completion, blocking both agents indefinitely. Escalation chains amplify the deadlock by routing circular dependencies to progressively senior orga- nizational levels, consuming increasingly expensive approval capacity and extending paralysis from hours to days. Single- agent workflows with sequential approvals avoid circular de- pendencies because one agent’s approvals do not depend on that agent’s own future outputs. RWA 137 - Cascading Approval Bottlenecks in Sequen- tial Multi-Agent Workflows Creating Compound Latency. Multi-agent sequential workflows that require independent human approval at each stage create compound latency and throughput degradation where total processing time scales linearly with the number of approval stages. Per-stage reviewer pools cannot parallelize across serial dependencies, multiply- ing both reviewer headcount requirements and customer-facing latency relative to a single-approval baseline. Peak demand creates queue backlogs that propagate across subsequent peri- ods, further compounding the throughput degradation. 14) RWA 14 - Infrastructure and Deployment Attacks: RWA141 - Embedding Batch Processing Timing Side- Channels in Shared GPU Infrastructure. Shared GPU infras- tructure processes embedding requests in batches, and batch timing patterns leak information about concurrent queries from other agents. Attackers can infer what other agents are querying by crafting query sequences with known embedding characteristics and measuring response times. Multi-agent systems sharing GPU batch processing create timing side- channels where one agent’s requests are batched with others, enabling inference about concurrent agents’ query patterns. RWA 142 - GPU Embedding Resource Exhaustion Through Adversarial Batch Flooding. Adversarial maximum- context queries force GPU embedding services to process requests sequentially rather than in batches, severely degrading throughput and increasing latency for all agents sharing the GPU infrastructure. Multi-agent shared GPU infrastructure enables one agent’s adversarial batching to exhaust shared resources, creating denial-of-service vulnerabilities where one compromised agent impacts the entire ecosystem. RWA 143 - CI/CD Pipeline Artifact Injection via GitHub Actions Credentials Compromise. Compromised CI/CD cre- dentials enable attackers to inject backdoors during the build stage, affecting all subsequent deployments built through that pipeline. Multi-agent deployment pipelines with shared CI/CD infrastructure enable attackers to poison all agents simultane- ously through a single credential compromise. RWA 144 - Load Balancer Health Check Gaming via Specification Mismatch. Agents can optimize for fast health check responses while omitting information that monitor- ing agents need for accurate capacity planning. Multi-agent health aggregation across N agents creates N opportunities for specification gaming where each agent’s health response interpretation diverges from monitoring agent expectations, leading to system-wide miscalibration. RWA 145 - GPU Utilization Optimization Gaming Through Batching Manipulation. Agents serving other agents can manipulate batch sizes to achieve locally higher GPU uti- lization at the cost of upstream latency, creating specification misalignment between agents optimizing locally rather than globally. Unlike singular systems with consistent batching, multi-agent batching gaming creates emergent latency degra- dation through local optimization conflicts. RWA 146 - Kubernetes Secret Store Poisoning for NGC API Keys and Credentials. Compromising one NGC API key secret in the Kubernetes secret store (etcd) affects all NIM services authenticating through that secret. Centralized secret management optimizes operations but creates single points of failure where credential compromise propagates to all agents using those credentials simultaneously. RWA 147 - Auto-Scaling Tool Quota Exhaustion. Auto- scaling events that launch replica fleets simultaneously exhaust tool quotas across new replicas, providing attackers distributed quota access through the scale-up event. Singular agent quota exhaustion is linear; auto-scaling enables distributed quota exhaustion creating supralinear depletion through coordinated replica resource allocation. RWA 148 - Health Check Endpoint Manipulation En- abling Degraded Multi-Agent Deployment. Attackers who modify health check configurations (relaxing thresholds, dis- abling critical dependency checks) enable deployment of de- graded instances that pass automated health validation while delivering poor service quality. Multi-agent systems with cen- tralized health check logic amplify the attack impact so that one configuration modification allows simultaneous deploy- ment of degraded instances across the entire fleet, creating coordinated performance degradation invisible to monitoring systems. RWA 149 - MIG Reconfiguration Attacks Forcing Node Draining and Cascading Capacity Exhaustion Across Multi- Agent Kubernetes Clusters. Adversaries with Kubernetes API or ConfigMap access can trigger unnecessary MIG profile reconfigurations across multiple GPUs simultaneously, forcing coordinated node draining that evicts more pods than the cluster can reschedule, causing admission control failures and fleet-wide capacity exhaustion. The reconfiguration validation delays extend capacity reduction windows, and mixed profile fragmentation can strand significant idle capacity in wrong partition sizes creating artificial scarcity. 15) RWA 15 - Tool Invocation and Selection Gaming: RWA151 - Tool Invocation Frequency Gaming via Obser- vation Manipulation. Agents optimizing for metrics like ”tasks completed per session” may learn to invoke tools unnecessarily to satisfy task counts, treating invocations as measurable outputs rather than means to legitimate ends. Multi-agent systems where task completion metrics aggregate across agents enable distributed gaming where each agent independently over-invokes tools, and no single agent appears malicious though collective behavior represents specification gaming. RWA 152 - Memory Integration with Poisoned Tool Invocation Chains. LangChain agents with memory systems can encode successful tool invocation sequences in memory, and when memory is poisoned with malicious invocation chains, agents reproduce those chains in future sessions. Multi- agent memory sharing enables poisoned invocation chains to propagate across agent boundaries throughout the fleet. RWA153 - GroupChat Tool Availability Negotiation Enabling Covert Tool Access. AutoGen’s GroupChat enables agents to negotiate tool availability through dialogue, creating covert access patterns where agents enable tools for peers without administrator authorization. Attackers can manipu- late negotiation to make dangerous tools appear consensus- approved. Singular systems have administrator-controlled tool access; AutoGen’s negotiation-based availability enables social engineering of tool access through peer influence. RWA 154 - Streaming Tool Invocation Enabling Partial Execution Gaming. Streaming tool results create opportunities for agents to report completion based on partial output, gaming ”analysis completed” metrics without full execution. Multi- agent tool chains amplify this because each agent in the chain reports task completion based on partial information, creat- ing aggregate success metrics while actual analysis remains incomplete throughout the chain. RWA 155-ToolSelectionGamingThrough Temperature-ControlledRandomness.Agentscantune sampling temperature to generate outputs that appear diverse while statistically biasing toward preferred (potentially malicious) tools through controlled sampling distributions. Downstream agents trusting tool-selection diversity metrics are systematically routed to compromised tools, with the gaming only detectable through statistical analysis of long-term selection patterns rather than individual decisions. RWA 156 - SLA-Driven Tool Selection Gaming Through Latency Falsification. Tools can falsify latency measurements to appear SLA-compliant, causing agents that prioritize tools with best latency metrics to inadvertently select malicious tools. Multi-agent tool orchestration with centralized tool rating systems enables poisoned ratings to affect all agents’ tool selections simultaneously; singular agents selecting tools based on latency face only per-agent gaming risk. RWA 157 - KV Cache Sharing Between Tool Outputs and Tool Selection. In deployments with shared KV caches, attention patterns from one tool’s output can bias the selection of subsequent tools, enabling attackers to design tool outputs that systematically steer subsequent tool selection toward dangerous options. Multi-agent systems with different tool combinations create cross-agent tool coupling vectors through shared caches, enabling systematic tool-selection hijacking across the agent network. RWA 158 - Rule Description Injection in Tool Selection. Rule-based agents that select tools based on descriptions are vulnerable to description poisoning in shared repositories where injected instructions cause agents to prefer tools with poor safety properties. Multi-agent shared tool ecosystems en- able poisoned descriptions to affect all agents’ tool selections simultaneously; single agents with hardcoded tool descriptions resist this. 16) RWA 16 - Framework-Specific Vulnerabilities: RWA161 - LangChain Tool Loading Vulnerability via Un- trusted Tool Definitions. LangChain’s dynamic tool registra- tion creates attack surfaces when tool definitions are loaded from untrusted sources (RAG-retrieved documents, external APIs), enabling poisoned schemas to create malicious tools that appear legitimate. Multi-agent systems with centralized tool catalogs enable one poisoned tool definition to affect all agents; distributed systems with agent-local tool definitions resist this attack. RWA 162 - AutoGen Tool Negotiation Creating Implicit Tool Access Chains. AutoGen enables tool recommendations through dialogue, creating implicit tool access chains where agents negotiate tool availability without explicit centralized policy. Attackers can influence the conversational negotia- tion to make dangerous tools appear available or neces- sary. Singular agent tool access is explicit and centralized; AutoGen’s conversational negotiation creates implicit access control through dialogue, enabling social engineering of tool availability. RWA 163 - Guardrail Configuration Tampering in Cen- tralized NeMo Deployments Enabling Fleet-Wide Safety By- pass. Production NeMo Guardrail deployments organize safety enforcement through multiple rail types configured via shared policy files, and centralized configuration creates tampering vectors where adversaries modifying shared policies bypass safety controls across all agents simultaneously. Attackers can relax jailbreak detection thresholds, manipulate approval workflow triggers to allow high-value unauthorized operations, or degrade hallucination detection cascades by disabling ver- ification stages. IV. ANALYSIS OF THREAT EVOLVEMENT Autonomous AI agents have evolved rapidly. Early con- versational models such as GPT-3 operated as self-contained text generators (monolithic chatbots). Over 2023–2024, agents gained the ability to remember context, call external tools or APIs, browse the web and reason autonomously. By 2025 the field shifted toward compound or multi-agent systems where several specialized agents collaborate. Each transition has changed the risk profile. This report categorizes this progression into four distinct eras: the initial monolithic chat- bots, tool-using single-agent systems, the rise of compound multi-agent architectures, and the emerging issues defining the current 2026 landscape. This report synthesizes academic papers, industry analyses, CVEs and security taxonomies to trace how threats, risks and vulnerabilities evolved through these stages. A. Early monolithic chatbots (c. 2022 – early 2023) Earlier language models consisted of a single LLM with- out persistent memory or tools. For example, models like GPT-3 responded in a stateless manner and did not possess autonomous planning capabilities. These models had limited integration points. The interface was typically limited to a prompt and a response, with no access to external tools or vector stores. These evolutions are described in Table I. With monolithic models, threats were primarily prompt-level, where a malicious user could coerce the model to reveal secrets or produce disallowed content. The attack surface was confined to text prompts and responses. However, even at this stage the seeds of future issues were present: prompt injection and training-data leakage implied that any future system building on these models would need robust input sanitization and privacy controls. B. Tool-using single-agent systems (mid-2023 – mid-2024) Agents gained autonomy, memory, and tool access. Appli- cations such as Auto-GPT [12], BabyAGI [13], and LangChain [14] Agents allowed an LLM to plan tasks, recall context from long-term memory, browse the web, execute code, and send emails. Retrieval-augmented generation (RAG) [15] became common, as many agents used vector-store memories to re- trieve information from documents or knowledge bases. De- spite autonomy, these systems still relied on a single controller, TABLE I: Key security vulnerabilities identified in early monolithic LLMs (c. 2022–2023). VulnerabilityDescription Prompt injectionIn May 2022 researchers at Preamble responsibly disclosed to OpenAI that GPT-3 could be coerced to ignore safety instructions by embedding malicious commands in the user prompt or in external content. Preamble initially called it a “command injection” because it resembled SQL injection; the term “prompt injection” was adopted later. They warned that AI agents increase the likelihood of prompt injection because agents integrate more APIs and have a larger attack surface [10] Adversarial examples & jailbreaks[10] demonstrated that handcrafted adversarial examples could cause GPT-3 and BERT models to output erroneous or harmful text. The authors highlighted a “major security vulnerability” in GPT-3, showing that minimal token-level perturbations significantly degrade performance and bypass quality checks. Training-data leakage & membership inferenceLLMs memorize parts of their training data. Research found that two prominent privacy risks, i.e., training-data extraction and membership inference attacks are interconnected. Attackers can prompt an LLM to generate large amounts of text and then apply membership inference to determine whether specific data were in the training set. Follow-on work showed that despite claims of strong generalization, training-data extraction is feasible, and membership-inference techniques can differentiate training samples from non-training samples [11] Model inversion & data exfiltrationEarly experiments showed adversaries could reconstruct sensitive data (e.g., medical images) from model outputs [11]. These attacks illustrated that even monolithic LLMs can leak confidential training data when given cleverly crafted prompts. with one LLM acting as the orchestrator. Enabling agents to use tools and memory expanded the attack surface far beyond the prompt, highlighted in Table I. Attackers can now deliver malicious instructions through websites, emails or documents; poison vector stores; or exploit poorly sandboxed code. Be- cause these systems typically rely on a single orchestrator, failure in one component compromises the entire workflow. This generation marks the transition from simple prompt-level risks to memory, tool and RAG vulnerabilities. C. Compound / multi-agent systems (mid-2024 – 2025) Multiple specialized agents coordinate via natural- language messages, with frameworks such as MetaGPT [17], ChatDev [18], Self-Organizing Multi-Agent Systems [19], and Microsoft 365 Copilot [2] having planners, coders, testers, critics, and human-interaction agents. These systems use de- centralized architecture, where agents can run on different servers and exchange messages asynchronously, and trust among agents is often implicit. Collective reasoning emerges as agents decompose complex tasks, debate answers, and vote on decisions. Multi-agent systems amplify earlier vulnera- bilities and add new layers, which have been organized in Table I. Inter-agent trust exploitation and communication attacks create high success-rate compromise paths (82.4 % vs. 41 % for direct injection) [20], and shared memories and common toolkits act as single points of failure, as a poisoned memory or compromised agent cascades across the system. Additionally, real-world incidents like EchoLeak [21] demonstrate that zero-click prompt-injection can cause remote data exfiltration, illustrating how natural-language interfaces cross the boundary between AI logic and network security. D. Emerging issues and future outlook (late 2025 – 2026) OWASP released the Agentic AI Top 10, synthesizing inci- dents observed in production deployments. It lists the follow- ing risk categories and corresponding examples in Table IV. Researchers have evaluated memory poisoning attacks and proposed new defenses [16], with these defenses including the moderation of input and output, as well as using trust-aware memory sanitization. Attacks such as MINJA can be very successful by embedding malicious instructions. As a result, defenses need to carefully calibrate trust thresholds so that benign entries are not blocked. Researchers are also studying secure communication frameworks to mitigate Agent-in-the- Middle attacks. Their proposals include cryptographic signing of messages, using authenticated channels, and tracking the provenance of each message [22]. Standards organizations such as NIST and OWASP are developing guidelines for policy-governed multi-agent systems. These guidelines address runtime policy enforcement, cross-agent identity management, and supply-chain trust. V. MANAGEMENT FRAMEWORKS FOR AGENTIC AI RISKS The integration of artificial intelligence into the corporate workforce has transitioned from a period of experimental augmentation to an era of delegated autonomy. By 2025 and into 2026, AI agents have become more integrated into enterprise infrastructure. Unlike traditional software, which functions through deterministic code paths, these agentic sys- tems utilize LLMs as central controllers to interpret high-level human intents and translate them into actionable tool calls and environmental interactions. This paradigm shift necessitates a fundamental rethinking of cybersecurity, as the autonomous nature of these systems introduces vulnerabilities that tradi- tional frameworks were not designed to accommodate. To address the security of agentic systems, the industry has gravitated toward several specialized frameworks that categorize threats and prescribe defensive measures such as the OWASP Top 10, and the MITRE ATLAS frameworks. These frameworks provide a common language for technical TABLE I: Emerging vulnerabilities in tool-augmented and RAG-enabled single-agent systems. VulnerabilityDescription Memory/context poisoningMicrosoft’s red-team taxonomy describes memory poisoning: attackers inject malicious instructions into an agent’s long-term memory, causing future actions to be manipulated (e.g., adding a hidden C address to every email) [9]. An attack called MINJA (Memory Injection) shows that query-only interactions can achieve over 95% injection success and 70% attack success [16]. The attack embeds hidden instructions in seemingly benign queries and uses bridging steps to ensure they are stored and later retrieved. Memory poisoning is serious because agents rely on past context when deciding to execute tools. Targeted knowledge-base poisoning (RAG poisoning)Attackers can poison a retrieval knowledge base by inserting malicious documents or instructions. Microsoft’s taxonomy notes that targeted knowledge-base poisoning becomes more impactful as RAG systems allow agents to ingest large volumes of untrusted data [9]. BadRAG and AgentPoison attacks demonstrate that embedding carefully crafted triggers into a small fraction of documents (0.1 %) can cause the agent to retrieve malicious examples whenever a trigger word appears. AgentPoison achieves≥80 % attack success with negligible impact on benign performance. Cross-domain prompt injection (XPIA)Agents with tool-calling capabilities risk executing arbitrary commands. The National Vulnerability Database reported CVE-2023-37274 in Auto-GPT: the executepythoncode command did not sanitize file names, allowing path-traversal to overwrite any .py file outside the workspace. Attackers could overwrite autogpt/main.py and achieve arbitrary code execution on the host. Running Auto-GPT inside a VM was recommended as a workaround [9]. This incident shows how unsanitized tool arguments can turn LLM autonomy into remote-code-execution vulnerabilities. Denial of service via recursive invocationTrend Micro notes that poorly configured agents can recursively invoke themselves or other agents, leading to infinite loops and service exhaustion [1]. teams and compliance officers to translate abstract algorithmic vulnerabilities into manageable security controls. A. MITRE ATLAS MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a living knowledge base of adversary tactics and techniques against AI-enabled systems, maintained by The MITRE Corporation and modeled after the MITRE ATT&CK framework [5]. It catalogs 14 adversar- ial tactics—from Reconnaissance and Resource Development through ML Attack Staging, Exfiltration, and Impact—along with corresponding techniques, real-world case studies, and mitigations. The Spring 2025 release significantly expanded coverage of generative AI attack vectors, adding 19 new tech- niques including RAG Poisoning, False RAG Entry Injection, LLM Prompt Crafting, Impersonation, and AI Supply Chain Compromise. MITRE ATLAS demonstrates its strongest coverage in the domains of prompt injection and retrieval-augmented gen- eration attacks, model training and supply chain integrity, and multi-agent trust exploitation. The Spring 2025 tech- niques—RAG Poisoning, False RAG Entry Injection, Retrieval Content Crafting, and Gather RAG-Indexed Targets—directly map to the most consequential data-layer attack vectors in agentic systems, including semantic memory knowledge base poisoning, knowledge graph relationship manipulation, and centralized tool registry poisoning via vector database meta- data injection. These techniques are documented with real- world case studies such as financial transaction hijacking in en- terprise copilot deployments and the Morris I self-replicating prompt worm, giving practitioners concrete demonstrations of how retrieval content manipulation achieves adversarial outcomes across multi-agent pipelines. The companion SAFE- AI report further maps ATLAS threats to NIST SP 800-53 controls, providing a pathway from threat identification to operational countermeasure [25]. ATLAS provides strong coverage of prompt injection prop- agation across agent architectures. Its LLM Prompt Crafting, LLM Jailbreak, LLM Prompt Obfuscation, and LLM Trusted Output Components Manipulation techniques address the full spectrum of adversarial content crafted to manipulate LLM behavior through natural language channels, including self- replicating prompt worms propagating via conversation history sharing, reasoning trace poisoning that embeds malicious jus- tifications within chain-of-thought explanations, and indirect prompt injection via web content or tool outputs processed by downstream agents. Tool and command injection in agentic pipelines—where malicious content in project files or inline suggestions causes tool-executing agents to perform adversary- intended operations—is cataloged under both LLM Prompt Crafting and the Execution tactic. At the model and supply chain layer, ATLAS is the most comprehensive threat catalog available among reviewed frame- works. Techniques including Backdoor ML Model, Training Data Poisoning, AI Supply Chain Compromise via Container Registry, Manipulate AI Model: Embed Malware, and Cor- rupt AI Model cover model checkpoint tampering, backdoor insertion via fine-tuning data contamination, LoRA adapter pa- rameter poisoning, TensorRT engine substitution, and MLflow model registry identity spoofing. ATLAS mitigations—Verify ML Artifacts, code signing, Control Access to ML Models, and Validate ML Model—provide directly applicable counter- measures for training and supply chain integrity gaps. The Spring 2025 additions of Impersonation and Masquerading TABLE I: Novel attack vectors in compound and decentralized multi-agent architectures. VulnerabilityDescription Inter-agent trust exploitation / peer-trust blind spotThe Dark Side of LLMs study demonstrates that multi-agent systems introduce three main attack vectors: direct prompt injection (success rate 41.2 %), RAG backdoor attacks (52.9 %), and inter-agent trust exploitation (82.4 %). Even when a model resists malicious commands from a human, it may execute the same command if another agent requests it [20]. EmergentMind explains that attackers can craft malicious metadata or error messages so that an orchestration agent trusts a malicious agent; the victim agent executes commands because it assumes peer messages are trustworthy. This peer-trust blind spot underscores that the trust boundary has shifted from human vs. model to agent vs. agent. Communication-layer attacks (Agent-in-the-Middle)He et. al. [22] introduces the Agent-in-the-Middle (AiTM) attack. Unlike attacks that directly compromise an agent, AiTM intercepts and manipulates messages between agents. The attacker eavesdrops on inter-agent communication and injects malicious instructions, thereby altering the system’s output. The researchers show that communication frameworks are a critical yet unexplored vulnerability, and by intercepting messages the adversary can compromise entire multi-agent systems. They highlight that existing multi-agent research mainly secured individual agents, leaving communication channels unprotected. Cascading failuresOWASP explains that multi-agent systems are prone to cascading failures: one compromised agent can poison downstream agents via shared memory or message passing [6]. Supply-chain and external-dependency poisoningMulti-agent systems often depend on microservices, plug-ins or other agents hosted by third parties. OWASP’s Agentic Top 10 lists Agentic Supply Chain Vulnerabilities (ASI04): dynamic multi-component pipelines (MCPs) can be poisoned via malicious updates or compromised dependencies; natural-language execution paths can lead to remote-code execution [6]. Memory and context poisoning at scaleMulti-agent systems share memory modules or vector stores. A memory injection attack (MINJA) can inject malicious instructions into shared memory, causing multiple agents to retrieve and act on poisoned data [16]. OWASP documents that malicious calendar invites in Gemini could implant persistent instructions that re-emerge across sessions and trigger actions like opening smart-home devices [21]. Insecure external communication and zero-click prompt injectionThe EchoLeak case (CVE-2025-32711) showed that a single crafted email could exploit multiple weaknesses in Microsoft 365 Copilot. The attack chain evaded Microsoft’s Cross-Prompt-Injection-Attempt classifier, bypassed link redaction via reference-style Markdown, used auto-fetched images, and abused a Microsoft Teams proxy domain to exfiltrate data. The result was remote, unauthenticated data exfiltration through zero user interaction. NIST and OWASP subsequently called indirect prompt injection “generative AI’s greatest security flaw” [21]. Human-agent trust exploitation and reward hackingOWASP notes that humans tend to trust agents’ confident responses. When compromised, agents can present malicious actions with perfect confidence, causing humans to approve harmful transactions [6].Researchers have documented reward hacking in AI agents, where optimization over flawed proxy reward functions leads to behaviors that maximize proxy metrics at the expense of true objectives. For instance, Skalse et. al. [23] formally define reward hacking as the phenomenon where increasing a proxy reward can decrease the intended true reward, demonstrating that imperfect objectives are intrinsically hackable. [24] show through large-scale empirical analysis that agents exploit proxy metrics in diverse reinforcement learning and alignment tasks, highlighting systematic proxy gaming behaviors across both RL and LLM environments. Rogue agents / misalignmentIn severe cases an agent may evolve goals that conflict with its intended purpose. OWASP’s Rogue Agents document incidents where autonomous agents deviated from intended behavior, including hallucination-driven deletion of production data and unintended destructive actions [6]. techniques address agent identity spoofing in multi-agent sys- tems, where adversaries present content as originating from trusted agents by manipulating metadata fields that dashboards and inter-agent communication protocols treat as authoritative. The Cost Harvesting technique and Denial of ML Service impact category address the economic resource abuse dimen- sion of multi-agent coordination, covering reflection-amplified resource exhaustion and unauthorized consumption of cloud AI compute. Across all these domains, ATLAS consistently names the attack class, provides real-world case studies, and specifies mitigations, though it stops short of prescribing moni- toring architectures or framework-specific detection signatures. B. ATFAA/SHIELD The ATFAA/SHIELD framework, authored by Nara- jala and Narayan of Amazon Web Services, is a two- component security architecture for enterprise generative AI agents [7]. ATFAA (Advanced Threat Framework for Autonomous AI Agents) taxonomizes nine primary threats across five domains—cognitive architecture, temporal per- TABLE IV: The OWASP Agentic AI Top 10 (2025): Risks and observed industry incidents. ASI codeRisk and example (from OWASP Top 10) ASI01: Agent Goal HijackHidden prompts within external content can hijack an agent’s objectives. EchoLeak is a real example. ASI02: Tool MisuseAgents misuse privileged tools when manipulated. Incidents include Amazon Q Code Assistant executing destructive shell commands because a malicious extension enabled a “YOLO” mode (auto-approve all tools). ASI03: Identity and Privilege AbuseCompromised agents inherit sensitive privileges (database access, cloud APIs). Attackers have used VS Code’s AGENTS.MD file to convince chat agents to email internal data. ASI04: Agentic Supply-Chain VulnerabilitiesDynamic multi-component pipelines can be poisoned through compromised plug-ins (e.g., Langflow AI RCE vulnerability). ASI05: Unexpected Code ExecutionNatural-language execution paths can lead to remote code execution (Auto-GPT RCE is an example). ASI06: Memory and Context PoisoningPoisoned data reshapes agent behavior long after the initial interaction—Gemini memory attack demonstrated how hidden prompts changed saved information. ASI07: Insecure InterAgent CommunicationSpoofed messages misdirect clusters of agents; “Agent Session Smuggling” allowed rogue agents to maintain multi-turn conversations by exploiting trust in A2A protocols. ASI08: Cascading FailuresA compromised agent can poison downstream agents. ASI09: Human-Agent Trust ExploitationAgents present malicious actions confidently; humans approve risky transactions. ASI10: Rogue AgentsAgents may autonomously pursue misaligned goals, such as deleting backups to reduce costs. sistence, operational execution, trust boundary, and gov- ernance circumvention—while SHIELD operationalizes de- fenses through six complementary control strategies: Seg- mentation (S), Heuristic Monitoring (H), Integrity Verifica- tion (I), Escalation Control (E), Logging Immutability (L), and Decentralized Oversight (D). The framework explicitly targets emergent security properties of agentic systems aris- ing from autonomous reasoning, persistent memory, dynamic tool integration, and minimal human oversight that existing frameworks do not fully address. ATFAA/SHIELD’sstrongestmitigationsinvolve infrastructure-level and trust-boundary threats. For tool executioninfrastructurerisks,SHIELD’sSegmentation prescribes API gateways with deep packet inspection, Docker network segmentation, Kubernetes Network Policies, and service mesh configurations. Escalation Control through Attribute-Based Access Control enforced by Open Policy Agent and Just-in-Time credential access directly addresses privilege escalation through compromised orchestration layers. For microservices and Kubernetes security, the alignment spans certificate integrity, registry image signing, shared service account credential misuse, and ClusterRole privilege escalation—all mapping to Integrity Verification and Escalation Control. Memory poisoning and RAG threats also receive strong direct support. ATFAA’s T3 threat (Knowledge, Memory Poi- soning, and Belief Loops) explicitly models how poisoned episodic or semantic memory stores propagate malicious behavior through self-reinforcing retrieval cycles. SHIELD’s Integrity Verification responds with cryptographic integrity proofs including HMACs and Merkle Trees applied to per- sistent data stores and vector databases. For inter-agent trust exploitation, ATFAA’s T6 (Identity Spoofing) combined with Integrity Verification and Escalation Control together prevent message injection, relay attacks, transitive trust collapse, and circular verification loops by enforcing cryptographic identity binding at the message level. Approval workflow exploitation receives strong coverage through Decentralized Oversight, which distributes approval authority across independent val- idators with adaptive governance thresholds, structurally de- fending against sequential bottlenecks and circular human-in- the-loop dependencies. The framework’s coverage is weakest where risks move into model-internal behaviors, client-side web security, UI/UX design, or emergent multi-framework orchestration properties. C. Cisco A2A Scanner Narajala, Habler, Huang, and Kulkarni present a systematic security analysis of Google’s Agent-to-Agent (A2A) protocol applying the MAESTRO threat-modeling framework to assess risks across the A2A communication stack [26]. The Cisco A2A Scanner specifies concrete security controls: AgentCard digital-signature verification and input sanitization; mutual TLS with OAuth 2.0/OIDC and JWT-based per-request au- thentication; nonce-and-MAC-based task replay prevention; strict schema validation; TLS 1.3 with certificate pinning and DNSSEC; artifact integrity hashing; audit logging with tamper-evident integrity; and supply-chain security via SBOM and dependency scanning. The framework is explicitly scoped to A2A protocol communication security and does not address model-level cognitive vulnerabilities, hardware-level attacks, or UI/UX design concerns. The framework’s strongest mitigations are tightly coupled to A2A protocol mechanics. AgentCard poisoning is countered with input sanitization, whitelist-based character validation, special-character escaping, schema-level type constraints, and digital signatures from trusted Certificate Authorities. Related risks—parameter injection across agent boundaries, authoriza- tion bypass, and supply-chain tool registry attacks—each re- ceive partial coverage because the framework’s authentication, SBOM, dependency pinning, and artifact-integrity controls apply meaningfully to the communication and provenance layers while leaving model-level and UI-level dimensions unaddressed. Authentication and transport security form the second pillar: mTLS, OAuth 2.0/OIDC, JWT validation, and DNSSEC mitigate service-discovery spoofing, Kubernetes token-replay attacks, microservices TLS-downgrade scenarios, and inter-agent trust chain exploitation. Nonce, timestamp, and MAC controls for task replay prevention directly address event-driven replay attacks on asynchronous A2A workflows, while per-request authentication and RBAC address identity spoofing and approval workflow provenance tampering. SSE authentication and backpressure-aware rate limiting deliver moderate coverage for streaming-related risks. Across all 28 sections scoring above baseline, only one reaches the highest score (AgentCard security), reflecting consistent partial rather than comprehensive mitigation—a profile that results from deliberate scoping to the protocol layer, requiring defense-in- depth controls at every adjacent layer. D. NIST AI Risk Management Framework The NIST AI Risk Management Framework (AI RMF 1.0), published as NIST AI 100-1 in 2023, is a voluntary, lifecycle- oriented framework organized around four core functions— GOVERN, MAP, MEASURE, and MANAGE—providing or- ganizational structures, risk characterization methods, evalua- tion practices, and response mechanisms for trustworthy AI [3]. Its 2025 companion document, NIST AI 100-2e2025, extends the governance framework with a formal adversar- ial ML taxonomy covering evasion, poisoning, and privacy attacks on predictive AI systems and supply chain, direct prompting, and indirect prompt injection attacks on generative AI systems, including explicit treatment of RAG knowledge- base poisoning, backdoor installation, and multi-agent prompt worm propagation [4]. Together they constitute the primary U.S. federal reference for assessing and managing AI security risk. NIST AI 100-2’s adversarial ML taxonomy provides direct named coverage for the highest-scoring threat categories: RAG knowledge-base poisoning (referencing PoisonedRAG and Phantom attacks), backdoor poisoning in shared models, indirect prompt injection through shared conversation histories and serialized memory, model registry version manipulation as a supply chain vector, and training data contamination through RLHF feedback channels. In each area, the framework supplies concrete mitigations—spotlighting, hierarchical trust training, cryptographic artifact verification, data filtering, and sandbox- ing of retrieved content—that practitioners can operationalize directly. Across 84 categories scored at a moderate level, the GOVERN, MAP, MEASURE, and MANAGE functions create organizational obligations to identify, characterize, evaluate, and respond to threats spanning human oversight interfaces, multi-agent memory and state management, reasoning trace leakage, evaluation pipeline integrity, and trust boundary en- forcement during inter-agent communication. The privacy at- tack taxonomy (covering data reconstruction, membership in- ference, property inference, and model extraction) and indirect prompt injection taxonomy (covering availability, integrity, and privacy sub-objectives) extend coverage to multimodal embedding inversion and cross-agent context-stealing at the conceptual level. Coverage gaps cluster in hardware-level and distributed infrastructure attacks, streaming and caching race conditions, and highly specialized internal agent decision- logic attacks, reflecting the framework’s deliberate design as a governance and ML security instrument rather than an infrastructure security standard. E. NSA AI Data Security The NSA AI Data Security framework is a joint Cyberse- curity Information Sheet (CSI) published in May 2025 by the NSA Artificial Intelligence Security Center, CISA, the FBI, and Five Eyes partner agencies, providing ten best practices (BP1–BP10) for securing data across all six NIST AI RMF lifecycle stages [27]. The framework addresses three principal risk areas—data supply chain integrity, maliciously modi- fied data, and data drift—through cryptographic provenance tracking, integrity verification, access controls, encryption, and privacy-preserving techniques. It is scoped specifically to the data resources used during AI development, testing, and operation. BP1 requires cryptographically signed append-only prove- nance ledgers; BP2 mandates checksums and cryptographic hashes for integrity verification; BP3 calls for quantum- resistant digital signatures (referencing NIST FIPS 204 and 205) to authenticate training and RLHF datasets. BP4 prescribes Zero Trust architecture and secure enclaves; BP5 requires sensitivity-based data classification extending to AI outputs; BP6 mandates AES-256 encryption at rest and TLS in transit with post-quantum cryptographic readiness. The data supply chain section analyzes split-view and frontrunning poisoning attacks on web-scale datasets, prescribing curator certification, cryptographic hash verification, and consensus- based domain trust. The maliciously modified data section addresses adversarial ML, statistical bias injection, deduplica- tion failures, and secure multi-party training pipeline integrity. The framework receives non-trivial strength scores across 19 risk subcategories, achieving the highest score for learning and training data attacks and scoring moderately across tool metadata poisoning, semantic memory and RAG pipeline at- tacks, vector database and embedding poisoning, ETL pipeline attacks, and model training backdoors. Its principal limitation is exclusive scoping to static data assets: it does not extend to runtime agentic attack vectors, retrieval logic vulnerabilities, UI security, or multi-agent coordination attacks. F. GAO AI Accountability Framework The GAO AI Accountability Framework (GAO-21-519SP, 2021) is a governance and oversight framework developed by the U.S. Government Accountability Office to promote accountability and responsible use of AI in federal agen- cies [28]. Organized around four complementary principles— Governance (practices 1.1–1.9), Data (practices 2.1–2.8), Per- formance (practices 3.1–3.9), and Monitoring (practices 4.1– 4.5)—it provides key practices, audit questions, and assess- ment procedures enabling independent verification of AI sys- tem behavior by auditors and third-party assessors. The framework’s most direct contributions emerge through its data governance practices (2.1 Sources, 2.2 Reliability, 2.8 Security and Privacy), its transparency and human supervision mandates (1.9 and 3.9), its traceability requirement (4.3), and its risk management planning obligation (1.6). These practices create genuine governance accountability pressure across risk domains involving data leakage, prompt injection via shared conversation history, memory and RAG pipeline poisoning, evaluation integrity, observability gaps, and ap- proval workflow exploitation. Practice 2.8 directly applies to securing shared conversational history and serialized agent state; practice 4.3 creates accountability for attribution logging failures that enable agent impersonation in multi-agent dash- boards; and practice 3.9 provides grounds to require human oversight workflows resistant to approval fatigue. Monitoring and drift-detection mandates (practices 4.2 and 4.4) apply to non-determinism and specification gaming risks. The frame- work’s applicability is structurally bounded by its nature as a governance accountability instrument: it provides no specific technical controls, no adversarial robustness specifications, and cannot detect or prevent low-level exploitation of multi-agent coordination infrastructure. All 79 assessed risk categories scored at a single moderate level, reflecting an instrument that establishes organizational accountability requirements and creates audit handles while leaving all technical implementa- tion details undefined—appropriate as a governance baseline requiring supplementation by technical security frameworks. G. CDAO GenAI Responsible AI Toolkit The CDAO Generative AI Responsible AI Toolkit (Ver- sion 1.0), published by the U.S. Department of Defense Chief Digital and Artificial Intelligence Office in December 2024, operationalizes the five DoD AI Ethical Principles (Respon- sible, Equitable, Traceable, Reliable, and Governable) across a seven-stage AI product lifecycle [8]. The toolkit provides lifecycle-embedded RAI Gate checkpoints, a SHIELD Assess- ment process for generating Statements of Concern, a RASCI accountability matrix, and a curated database of approximately 100 open-source and industry-standard RAI tools covering security, fairness, explainability, adversarial robustness, RAG evaluation, and continuous monitoring. The toolkit’s most substantive security contributions re- side in Stage 4 and Stage 5. Stage 4.1.4 directly mandates prompt injection prevention (recommending NeMo Guardrails, Guardrails AI, and LLM Guard), input sanitization, adversarial robustness testing, data poisoning detection, differential pri- vacy during training and fine-tuning, supply chain integrity via SBOMs, and rate limiting against denial-of-service. Stage 5 TEVV requires red-teaming, adversarial testing using tools such as GARAK and Prompt Fuzzer, and agent-specific testing via AgentBench. Stage 6 establishes formal incident response with chain-of-thought traceability and provenance require- ments; Stage 7 mandates continuous monitoring for behavioral drift using tools including Arize Phoenix, WhyLabs, TruLens, RAGAS, and MLflow. The curated RAI Tools List includes IBM Adversarial Robustness 360, TextAttack, Counterfit, Lla- maIndex Evaluation Tools, RAGAS for RAG pipeline security, and Microsoft Presidio for PII detection. Strongest coverage areas are RAG security, prompt injection prevention, train- ing data poisoning defenses, and vector database embedding integrity. Coverage gaps remain in framework-specific vulner- abilities (LangChain, AutoGen, CrewAI), hardware-level con- cerns (GPU memory isolation, Kubernetes RBAC), and multi- agent-specific threats such as trust exploitation through AI-to- AI social engineering and worm-like prompt propagation. H. OWASP Agentic Security Initiative The OWASP Agentic Security Initiative (ASI) is a suite of five interconnected documents produced by the OWASP GenAI Security Project addressing security of autonomous AI agent systems that combine LLM reasoning with tool execution, persistent memory, and multi-step planning [6], [29]. The initiative spans threat taxonomy, architectural threat modelling (the MAESTRO framework), developer and opera- tor security controls, a ranked Top 10 risk list (ASI01–ASI10), and governance and regulatory mapping. Its controls address the distinct threat surface of agentic AI—probabilistic non- deterministic behavior, dynamic runtime tool composition, per- sistent memory susceptible to poisoning, and multi-agent del- egation chains—rather than the single-inference threat model of earlier OWASP LLM guidance. The initiative’s ten ranked risk categories address the principal threat classes of agentic AI: goal hijacking through prompt injection and indirect manipulation (ASI01), tool mis- use via unsafe delegation and parameter injection (ASI02), identity and privilege abuse in multi-agent delegation chains (ASI03), runtime supply chain vulnerabilities from dynamic tool and plugin composition (ASI04), unexpected remote code execution from sandboxing failures (ASI05), memory and context poisoning of persistent and shared knowledge stores (ASI06), insecure inter-agent communication (ASI07), cascading failures from blast-radius amplification (ASI08), human-agent trust exploitation and decision-fatigue attacks (ASI09), and rogue agent misalignment (ASI10). Concrete control families span intent validation and goal locking at run- time, per-tool least-privilege enforcement by a pre-execution Policy Enforcement Point (the “Intent Gate”), just-in-time ephemeral credentials, execution sandboxes, memory content validation with rollback, supply chain provenance via SBOMs and AIBOMs with signed manifests, cryptographic inter-agent authentication using PKI and mTLS, circuit breakers against cascading failures, and behavioral monitoring. The framework’s strongest coverage lies in RAG pipeline and memory poisoning defense, tool and plugin supply chain integrity, multi-agent communication security, and ap- proval workflow protection. ASI06 addresses episodic and semantic memory attacks through content validation on all writes, source attribution, trust-weighted retrieval, session isolation, and rollback mechanisms. ASI04’s supply chain controls—content-hash pinning, signed manifests, curated registries, and staged rollout with differential behavioral tests—provide direct coverage of tool registry poisoning and model version integrity. ASI07’s typed contracts, schema validation, digital signatures, and anti-replay nonces counter inter-agent communication injection and conversation-history worm propagation. Coverage is moderate across data leakage scenarios (where access controls are partial against streaming and embedding-based channels), agent identity provenance, and non-determinism. Gaps remain in hardware-level GPU attacks, online reinforcement learning and MARL-specific threats, streaming-specific injection windows, and specialized planning architectures (MCTS, HTN). I. Google’s Approach to Secure AI Agents Google’s “An Introduction to Secure AI Agents” [30] is an application-architecture-level security framework addressing two primary AI agent risk categories—rogue actions and sensitive data disclosure—through three core principles: agents must have well-defined human controllers with explicit con- firmation required for critical or irreversible actions; agent powers must be dynamically constrained via least privilege, scoped OAuth tokens, and sandboxing; and agent actions and planning must be observable through robust logging and transparent UIs. The framework implements a hybrid defense- in-depth strategy combining deterministic Layer 1 policy en- gines (operating outside the AI model’s reasoning loop to intercept and evaluate action requests) with Layer 2 reasoning- based defenses including adversarial training, guard model classifiers, and plan analysis models, supported by continuous assurance through regression testing, variant analysis, and red teams. The framework’s strongest contributions are in prompt injection defense and tool security. By requiring structural prompt conventions (clear delimiters and role tagging to separate trusted instructions from untrusted external content), Layer 2 guard model classifiers, and input stream separa- tion, it directly addresses the primary mechanism through which adversaries hijack agent behavior via web content, files, emails, and tool outputs. These defenses extend naturally to RAG pipelines, where retrieved content must be treated as untrusted input, and to multi-agent scenarios where one agent’s output becomes another’s input. The framework’s explicit recognition that dynamically incorporating third-party tools introduces risks from deceptive tool descriptions and insecure implementations reflects accurate threat modeling of the tool and plugin ecosystem, and its authentication, authorization, and auditing requirements for tool use provide a principled access control baseline. Memory security is also addressed directly. The require- ment that memory implementations ensure strict isolation between users and contexts, combined with explicit acknowl- edgment that malicious data stored in memory can influence future agent behavior in unrelated interactions, corresponds to threat patterns involving episodic and semantic memory poisoning, vector store injection, and cross-agent memory contamination. The observability principle contributes across multiple threat categories: robust logging of agent inputs, tool invocations, parameters, outputs, and reasoning steps creates the audit trail necessary for detecting anomalous behavior, while transparent UIs provide users with visibility into agent reasoning and intended actions. The hybrid defense architecture is the framework’s most architecturally significant contribution. By placing determin- istic policy enforcement outside the AI reasoning loop, it explicitly compensates for the non-deterministic, potentially manipulable nature of AI model outputs. Plan analysis mod- els that evaluate proposed agent plans before execution ad- dress reasoning-level threats including chain-of-thought ma- nipulation and dangerous tool sequence embedding. This acknowledgment that AI non-determinism is a fundamental challenge—and that Layer 1 determinism is the structural response to it—reflects an accurate understanding of multi- agent security architecture. J. NIST AI 600-1 Generative AI Profile NIST AI 600-1 (Generative AI Profile) is a cross-sectoral companion profile to the AI Risk Management Framework (AI RMF 1.0), released in 2024 pursuant to EO 14110, providing governance and risk management guidance for generative AI systems across twelve risk categories [31]. Suggested actions are organized around four primary considerations— Governance, Content Provenance, Pre-deployment Testing, and Incident Disclosure—mapped to AI RMF subcategories (GOVERN, MAP, MEASURE, MANAGE). The profile ex- plicitly recognizes direct and indirect prompt injection and data poisoning as Information Security risks (§2.9), and supply chain integrity as a Value Chain and Component Integration risk (§2.12). Across evaluated categories with above-baseline scores, the framework’s coverage is consistently governance-level, reflecting its character as a risk management profile rather than a technical security standard. Three threat domains receive the most substantive partial coverage. In the prompt injection do- main, the Information Security category’s explicit recognition of prompt injection—combined with MEASURE 2.7’s man- date for red-teaming and adversarial testing—provides mean- ingful organizational pressure for evaluating injection attack surfaces across approval workflow exploitation (RATC 2), tool and function call injection (RIDC4), ReAct and reasoning architecture injection (RIDC5), self-replicating prompt worm propagation through shared conversation histories (RTE 41), and multi-hop indirect injection across agent orchestration hierarchies (RTE203, RTE204). In the supply chain do- main, the Value Chain and Component Integration category (§2.12) with GOVERN 6.1 and 6.2 directs organizations to vet third-party components and establish accountability, providing indirect coverage for tool and plugin registry at- tacks, model registry version manipulation, MLflow metadata injection, over-the-air update chain-of-custody corruption, and safetensors validation bypass. This supply chain governance framing applies at the procurement level and creates orga- nizational accountability structures that downstream technical controls can operationalize. In the data poisoning domain, the Information Security category’s recognition of data poi- soning provides governance framing for RAG knowledge base poisoning (RATC16, RTE221), vector database and embedding poisoning (RMP15, RTE214), ETL pipeline attacks (RMP 16), caching and persistence attacks (RMP5), parameter tuning and configuration poisoning (RMP8), and learning and training data attacks (RMP9). The Human-AI Configuration category’s treatment of automation bias and over-reliance, combined with GOVERN 3.2’s requirement for human oversight policies, provides governance rationale for addressing approval workflow vulnerabilities and confidence manipulation in tool authorization. The profile’s systematic limitation is the gap between governance obligations and technical controls: it mandates that risks be identified, measured, and assigned organizational ownership without prescribing the engineering mechanisms necessary to address them. It contains no controls for cryp- tographic memory integrity checking, multi-agent trust chain verification, runtime monitoring architectures, or framework- specific defenses for LangChain, AutoGen, CrewAI, and Se- mantic Kernel. Infrastructure-level attack surfaces including Kubernetes security, GPU hardware isolation, service mesh authentication, and container hardening fall entirely outside the profile’s scope. The profile functions as an organizational governance anchor directing pre-deployment evaluation effort while requiring supplementation by technical security frame- works for the full attack surface of agentic AI systems. K. DIU Responsible AI Guidelines The Defense Innovation Unit (DIU) Responsible AI (RAI) Guidelines operationalize the five DoD AI Ethical Principles— Responsible, Equitable, Traceable, Reliable, and Governable— across a three-phase AI lifecycle through a Development Worksheet and a Deployment Worksheet [32]. The Develop- ment Worksheet addresses five lines of inquiry: manipulation of data models, system performance monitoring, output verifi- cation, audit mechanisms, and governance roles; the Deploy- ment Worksheet requires continuous evaluation throughout the system’s operational lifecycle. The framework’s relevance to AI agent security is narrow and structurally bounded by its governance orientation. Among all evaluated risk categories, only twelve scored above the baseline—all at the moderate level—reflecting the guidelines’ function as an ethical oversight instrument rather than a techni- cal security standard. Sections achieving moderate applicabil- ity consistently involve threats to training data integrity, model behavior verification, and human oversight. The Development Worksheet’s “manipulation of data models” inquiry creates organizational accountability for reinforcement learning data poisoning, training-time backdoor injection, and RAG knowl- edge base manipulation. The “Governable” and “Responsible” principles provide governance-level rationale for resilient ap- proval workflows and guardrail infrastructure that fails safely; the “Traceable” principle’s auditability mandate creates insti- tutional pressure for reasoning transparency and evaluation telemetry; and the “Reliable” principle’s performance moni- toring requirements apply comparable pressure for evaluation integrity. Infrastructure-level attacks, prompt injection vec- tors, multi-agent trust exploitation, memory poisoning, and framework-specific vulnerabilities receive no coverage, reflect- ing the document’s honest baseline as an ethical accountability mechanism that establishes organizational questions without prescribing the technical controls necessary to answer them. L. DoD AI Cybersecurity Risk Management Framework The DoD Artificial Intelligence Cybersecurity Risk Man- agement Tailoring Guide (Version 2, July 2025), published by the DoD Chief Information Office in collaboration with OUSD(R&E) and OUSD(A&S), extends the NIST Risk Man- agement Framework and CNSSI 1253 control catalog to the full AI acquisition, development, deployment, monitoring, and disposal lifecycle across the Department of Defense [33]. Grounded in DoDI 8510.01, NIST SP 800-37, and NIST AI RMF 1.0, the guide maps MITRE ATLAS-derived AI threat vectors to prioritized CNSSI 1253 security and privacy con- trols. The disposal phase uniquely requires secure destruction of model weights, training datasets, test results, and associated containers. A consistent pattern emerges across evaluated threat scenarios: the framework’s strongest applicability lies in infrastructure-layer threats. Configuration management con- trols (CM family) address Kubernetes security context miscon- figuration, container orchestration RBAC misconfigurations, and API gateway routing manipulation. Supply chain controls (SR family: supply chain plans, provenance, risk assessment, anti-counterfeiting) address container registry attacks, MLflow artifact registry access control failures, and plugin dependency integrity. Access control and boundary protection (AC family and SC-7) apply to etcd database exposure, microservices authentication, service account impersonation, and network isolation bypass. Audit logging controls (AU family) cover conversation history accumulation, tool invocation parameter logging, error message aggregation, distributed tracing span data, and Kubernetes audit logs. SC-28 (protection of infor- mation at rest) extends to vector database storage, MLflow repositories, session caches, and etcd backups. The single section receiving the highest score—microservices and Ku- bernetes infrastructure attacks in multi-agent trust exploitation contexts—receives the most direct and operationally complete framework mapping from the convergence of CM, AC, SC- 7, SR, and SI-7 controls. SC-5 sub-controls address denial- of-service and resource exhaustion; SC-24 (fail in known state) applies to guardrail bypass through infrastructure failure injection; SI-6 (security function verification) covers detection of bypassed safety validation services; and CA-7 is explicitly cited for economic denial-of-service detection. The framework’s systematic gap is its ATLAS-derived threat taxonomy, constructed around classical machine learn- ing attacks, which does not model the novel attack surfaces of LLM agents. Semantic tool registry poisoning via natural- language descriptions, prompt injection from web-retrieved content, confidence score manipulation, streaming identity spoofing, reasoning-amplification cost attacks, and the emer- gent behavioral properties of swarm intelligence coordination have no applicable CNSSI 1253 controls. The framework’s authorization model assumes explicitly administered access policy rather than authorization emerging from agent dia- logue, and its integrity checking mechanisms address file-level modifications rather than probabilistic manipulation of LLM attention and retrieval. M. DoD Responsible AI Strategy The DoD Responsible AI Strategy and Implementation Pathway, prepared by the DoD Responsible AI Working Coun- cil and updated in October 2024, operationalizes five AI Eth- ical Principles—Responsible, Equitable, Traceable, Reliable, and Governable—across six Foundational Tenets with Lines of Effort and designated Offices of Primary Responsibility [34]. The Chief Digital and Artificial Intelligence Officer (CDAO) coordinates implementation across all DoD Components. The strategy functions as the authoritative DoD policy anchor for downstream AI security frameworks. Its Warfighter Trust tenet—through LOE 2.2.2—explicitly requires AI ven- dors to provide traceable feedback on system status and clear procedures for operators to activate and deactivate system functions, directly supporting human oversight of agentic tool chains. LOE 2.1.2 mandates development of a Test, Evalu- ation, Verification, and Validation (TEVV) toolkit including tools to detect adversarial attacks on AI systems and notify operators when such attacks occur. LOE 2.1.7 directs DoD- wide AI security guidance leveraging existing best practices in risk management, supply chain security, and cybersecu- rity. The strategy’s Desired End State explicitly warns that adversaries may seek to exploit supply chain vulnerabilities to inject flawed or exploitable capabilities into AI training, testing, and update cycles—providing direct policy grounding for supply chain threat assessments across tool registries, model repositories, and plugin ecosystems. Across 174 categorized threat categories, 27 sections score at the moderate level and no section exceeds this, reflecting the strategy’s character as a governance document that es- tablishes institutional mandates without prescribing technical mechanisms. Infrastructure-level attacks, reasoning-layer ex- ploits, and framework-specific vulnerabilities in LangChain, AutoGen, CrewAI, and Semantic Kernel receive no substantive technical coverage, as the strategy functions to authorize and direct downstream cybersecurity frameworks rather than to substitute for them. N. ENISA Multilayer Framework for AI Security The ENISA Multilayer Framework for Good Cybersecu- rity Practices for AI (FAICP), published by the European Union Agency for Cybersecurity in June 2023, provides a scalable three-layer security architecture for AI systems deployed within ICT infrastructure [35]. Layer I addresses ICT foundations—risk management, access control aligned to ISO 27002 and NIS2, availability management, supply chain security, and certification. Layer I addresses AI-specific ML- lifecycle threats (evasion, poisoning, model and data disclo- sure, component compromise) and AI trustworthiness prop- erties including robustness, resiliency, and security. Layer I provides sector-tailored guidance for energy, health, automo- tive, and telecommunications, referencing the proposed EU AI Act. The framework’s strongest coverage is training data and learning process attacks, where Layer I’s direct identification of data poisoning as a primary ML threat—combined with recommendations for provenance tracking, access control, and integrity verification of training datasets—applies to few-shot demonstration poisoning, reinforcement learning trajectory injection, and fine-tuning data contamination. Kubernetes and microservices network security receives direct support through Layer I’s TLS, PKI management, RBAC, and certificate lifecycle requirements, which map onto mTLS configuration attacks, service account impersonation, and container image signing. Across the 96 sections scoring at a moderate level, Layer I’s data integrity, access management, supply chain security, availability management, and audit logging guidance provides structural support for vector database access control, container image provenance, CI/CD pipeline integrity, load balancer security, and distributed denial-of-service resilience. Layer I’s poisoning category partially covers RAG knowledge base contamination, episodic and semantic memory poisoning, evaluation dataset integrity, and RL reward function attacks. Coverage consistently terminates at the boundary between conventional ICT security and agentic AI specifics. Published before modern agentic architectures became mainstream, the framework contains no guidance for prompt injection, multi- agent trust exploitation, self-replicating prompt malware, ap- proval workflow security, confidence score manipulation, or framework-specific vulnerabilities. The FAICP framework es- tablishes baseline ICT and ML security controls essential for any AI deployment but requires supplementation by agentic- specific guidance for the cognitive and coordination attack surfaces of modern agent systems. O. Guidelines for Secure AI System Development The UK National Cyber Security Centre, CISA, NSA, and nineteen additional international cyber agencies jointly pub- lished Guidelines for Secure AI System Development in 2023, structuring AI provider security guidance across four lifecycle phases: secure design, secure development, secure deployment, and secure operation and maintenance [36]. Guidance spans threat modeling, supply chain integrity, infrastructure harden- ing, model protection, behavioral monitoring, and responsible release. The framework’s most directly applicable guidance centers on four recurring themes. Prompt injection recognition and input sanitization provide partial coverage for data leakage through injection vectors, tool and command injection, and RAG knowledge base poisoning. Supply chain controls— SLSA attestation, SBOM maintenance, and cryptographic hashing of model weights—provide meaningful indirect cov- erage for model registry poisoning, tool metadata poisoning across registries, plugin and tool ecosystem supply chain attacks, container image integrity, and ETL pipeline data provenance validation. Infrastructure security guidance on environment segregation and least-privilege access controls partially addresses Kubernetes namespace isolation bypass, container orchestration privilege escalation, MIG co-location failure propagation, load balancer identity security, and ser- vice discovery authentication attacks. Behavioral monitoring requirements—specifically the mandate to observe sudden and gradual behavioral changes affecting security and to monitor inputs for adversarial content—provide a detection foundation for episodic memory poisoning manifesting as behavioral drift, efficiency baseline degradation, and gradual evasion patterns in metrics collection. The single section receiving the highest score is learning and training data attacks, where the framework’s explicit requirement to sanitize user feedback and continuous learning data directly addresses few-shot chain-of-thought demonstra- tion injection, reinforcement learning trajectory data injection, and fine-tuning data contamination through poisoned example selection. The principal limitation across all categories is architectural scope: designed as a general-purpose AI lifecycle security reference, the framework predates multi-agent orches- tration patterns and does not address agent-to-agent trust chain verification, reasoning trace authenticity, approval workflow fatigue, streaming-specific validation timing, multi-agent RL reward signal integrity, economic denial-of-wallet attacks, or the emergent misalignment risks of coordinated agent fleets. P. Deploying AI Systems Securely The joint NSA/AISC, CISA, FBI, and Five Eyes Cy- bersecurity Information Sheet on deploying AI systems se- curely (April 2024) organizes deployment security across three phases [37]. Phase 1 prescribes Zero Trust architecture, RBAC/ABAC access controls for model weights, sandboxed containers or VMs for ML model execution, GPU and CPU patch management, TLS encryption, hardware security mod- ules, phishing-resistant multifactor authentication, and network segmentation with firewall allow-listing. Phase 2 requires cryp- tographic artifact validation, adversarial testing, supply chain inspection in a secure development zone, input sanitization and prompt injection protection, comprehensive logging of inputs, outputs, intermediate states, and errors, and hardware- protected model weight storage. Phase 3 mandates external penetration testing, immutable backup log storage, automated rollback to last known good state, and full evaluation runs before redeploying updated model versions. The framework’s strongest contributions cluster where traditional IT security controls intersect with AI-specific de- ployment concerns. Prompt injection and input sanitization guidance directly but partially addresses data leakage through injection vectors, tool and command injection, and knowledge base poisoning in RAG pipelines. Supply chain inspection and cryptographic artifact validation cover tool registry and plugin ecosystem attacks, model registry poisoning, container image integrity, ETL pipeline data contamination, and train- ing backdoor insertion through pre-trained model reuse. In- frastructure controls—sandboxed containers, GPU patching, TLS, Zero Trust architecture—partially address Kubernetes container escape, MIG co-location hardware failure propaga- tion, inter-GPU communication security in tensor parallelism deployments, and microservices authentication attacks. The monitoring and logging mandate, oracle-attack alerting re- quirement, and immutable log storage provision provide a partial foundation for detection evasion analysis and audit trail integrity. Systematic gaps arise from the framework’s design as a general-purpose deployment security reference written be- fore multi-agent agentic architectures became mainstream. It contains no guidance on agent-to-agent trust chain verifica- tion, inter-agent confidence score integrity, reasoning trace authenticity, multi-agent RL reward signal integrity, episodic and semantic memory security beyond generic access con- trols, token economy and economic denial-of-service at- tacks, streaming-specific validation timing vulnerabilities, or framework-specific orchestration internals, leaving the multi- agent amplification dynamics that transform individually man- ageable threats into fleet-wide cascade failures without appli- cable guidance. Q. Other Observations 1) Model-Level Controls: Hardening the Reasoning En- gine: The first tier of defense resides at the model level, where the objective is to ensure that the ”brain” of the agent remains robust against manipulation. Recent research focuses on de- terministic rather than purely probabilistic defenses to handle the ”stochastic” nature of LLMs. The following summarizes the key techniques within this category. 1) Information-Flow Control (IFC): Researchers have pro- posed formal models using dynamic taint-tracking to attach confidentiality and integrity labels to all data an agent processes. This allows for deterministic decisions on whether a consequential tool call is safe, achieving a semantic characterization of security guarantees against indirect prompt injection [38]. 2) Tool Result Parsing: Yu et. al. [39] introduced a method that provides agents with precise data via ”tool result parsing,” effectively filtering out injected malicious code. This approach has demonstrated the lowest Attack Suc- cess Rate (ASR) recorded in academic literature while maintaining high utility. 3) Probabilistic Spotlighting: Published Microsoft research describes ”Spotlighting,” which helps models distinguish between system instructions and untrusted data by apply- ing signal transformations like datamarking (interleaving special characters) or encoding (base64) to external in- puts. Experiments showed that datamarking could reduce the Attack Success Rate from over 50% to below 2% [40]. 2) Agent System-Level Controls: Orchestration and Exe- cution Safeguards: The most significant security challenges in 2025/2026 occur at the orchestration layer, where agents inter- act with the external world. The risk of ”Excessive Agency” (OWASP LLM06:2025) arises when an agent is granted too much authority, such as the ability to delete records or send emails, without sufficient oversight or technical boundaries. The techniques associated with this group are as follows. 1) Zero-Trust Agentic Runtime: New research (2026) pro- poses a ”Zero-Trust Agentic Runtime Architecture”. This involves ”Deterministic Capability Binding” and ”Neuro- Symbolic Information Flow Control” to enforce security invariants across the agentic tool supply chain [41]. 2) FIDES Planner: A 2025 paper introduced the FIDES planner, which uses ”hiding and revealing” primitives to selectively isolate sensitive data from the agent’s context. This prevents malicious inputs from influencing future tool calls by keeping the reasoning ”clean” [38]. 3) Memory Hardening: The ”AgentSafe” framework utilizes permission-level classification and ”HierarCache” to pre- vent unauthorized memory access and memory poisoning in multi-agent environments [42]. 3) Human Oversight Controls: Verified Autonomy and Alignment: Human oversight remains the final and most critical layer of the agentic security stack. However, as agents operate at ”machine speed,” the role of the human must shift from approving every individual action to defining high- level boundaries and providing just-in-time approval for high- consequence operations. A structured summary of these meth- ods is provided below. 1) Formal Verification: The ”VeriPlan” system applies model checking to LLM-based agent plans. It allows users to define specifications and uses a model checker to verify that the agent’s proposed actions adhere to those constraints before execution [43]. 2) Bidirectional Human-AI Alignment: This study argues for a ”Bidirectional Human-AI Alignment” framework. This moves beyond just aligning the AI to human values by also addressing ”Aligning Humans to AI”, therein supporting the cognitive and societal adaptation required as agents take on greater autonomy [44]. VI. ANALYSIS OF THE FRAMEWORK To quantify and compare the security coverage of the sur- veyed frameworks, we systematically scored each framework against a taxonomy of 193 distinct agentic AI threat items spanning nine risk categories. As shown in section ??, the nine risk categories are: Agent-Tool Coupling (RATC, 21 items), Data Leakage (RDL, 34 items), Injection (RIDC, 7 items), Identity and Provenance (RIP, 19 items), Memory Poison- ing (RMP, 16 items), Non-Determinism (RND, 34 items), Trust Exploitation (RTE, 34 items), Timing/Monitoring (RTM, 12 items), and Workflow Architecture (RWA, 16 items). The relevance of the frameworks to each item was assessed on a three-point scale: score 1 (minimal guidance), score 2 (moderate, indirect coverage), and score 3 (direct and specific mitigation). A. Overall Framework Relevance to Agentic AI Security Figure 1 ranks all 16 frameworks by their coverage of the 193-item threat taxonomy. Coverage is the fraction of items for which a framework provides at least moderate guidance (score ≥ 2), split into moderate (score 2, light) and strong (score 3, dark) tiers. The OWASP Agentic Security Initiative (OWASP ASI) leads with 65.3% total coverage and the highest share of score-3 items (14.5%). CDAO GenAI and ATFAA-SHIELD follow at 62.2%, with CDAO GenAI showing the broadest moderate coverage (57.5%). MITRE ATLAS (52.8%) achieves the second-highest score-3 proportion (9.8%) owing to its explicit technique catalog. The middle tier—ENISA FAICP (50.8%), NIST AI RMF (48.7%), Google SecAI (44.0%), GAO AI (40.9%)—provides governance- and infrastructure- level partial coverage. The lower tier (NSA and DoD frame- works, Cisco A2A, NIST GenAI, DIU RAI) is constrained by lifecycle-specific or governance-only scope. B. Coverage by Threat Category Figure 2 shows the mean score per category averaged across all 16 frameworks. Memory Poisoning (1.578) and Workflow Architecture (1.543) receive the strongest aggregate coverage; Non-Determinism (1.231) and Data Leakage (1.340) are the most under-addressed categories. Table V identifies the best-performing framework per category. OWASP ASI dominates five of the nine cate- gories. MITRE ATLAS leads in trust exploitation and work- flow architecture. CDAO GenAI leads in data leakage and non-determinism through its mandatory monitoring toolset. ENISA FAICP leads in timing and monitoring via its ICT lifecycle controls. TABLE V: Highest-scoring framework per threat category. CategoryBest FrameworkAvg Agent-Tool CouplingOWASP ASI2.00 Data LeakageCDAO GenAI1.71 InjectionOWASP ASI / CDAO / MITRE2.14 Identity/ProvenanceOWASP ASI2.16 Memory PoisoningOWASP ASI2.12 Non-DeterminismCDAO GenAI1.68 Trust ExploitationMITRE ATLAS2.09 Timing/MonitoringENISA FAICP1.83 Workflow Arch.MITRE ATLAS2.06 01020304050607080 DIU RAI NSA DataSec DoD RAI Cisco A2A NIST GenAI NSA Deploy DoD AI Cyber NSA SecDev GAO AI Google SecAI NIST AI RMF ENISA FAICP MITRE ATLAS ATFAA-SHIELD CDAO GenAI OWASP ASI Coverage (% of 193 threat items) Moderate coverage (score 2) Strong coverage (score 3) Fig. 1: Coverage of 193 agentic AI threat items per framework, stacked by coverage tier. Frameworks sorted by total coverage (score ≥ 2) in descending order. OWASP ASI leads at 65.3%; DIU RAI provides the narrowest coverage at 6.2%. Non-Det. Data Leak. Trust Agt-Tool Timing Identity Injection Workflow Memory 1 1.2 1.4 1.6 1.8 1.23 1.34 1.37 1.42 1.42 1.46 1.52 1.54 1.58 Mean score (16 frameworks) Fig. 2: Mean coverage score (averaged across all 16 frame- works) per threat category, sorted weakest to strongest. No category reaches the 1.6 threshold where a majority of frame- works provide meaningful coverage. C. Coverage by AI System Lifecycle Phase Figure 3 compares the top four frameworks across three lifecycle phases: design (RATC, RIP, RWA; 56 items), devel- opment (RMP, RTM; 28 items), and operation (RIDC, RDL, RTE, RND; 109 items). For the design phase, OWASP ASI is the strongest (avg 2.054), providing architectural guidance on agent-tool coupling, identity binding, and workflow integrity. MITRE AT- LAS (1.732) and ATFAA-SHIELD (1.714) follow, target- ing design-time trust boundary decisions. For the devel- opment phase, CDAO GenAI leads (avg 1.929) through Stage 4 mandates for data poisoning detection, supply-chain SBOMs, and security testing tooling. For the operational DesignDevelopmentOperation 1 1.2 1.4 1.6 1.8 2 2.2 Mean score OWASP ASICDAO GenAI ATFAA-SHIELDMITRE ATLAS Fig. 3: Mean coverage of the top four frameworks across three lifecycle phases. Design: RATC, RIP, RWA (56 items); Development: RMP, RTM (28 items); Operation: RIDC, RDL, RTE, RND (109 items). phase, CDAO GenAI (1.651) and OWASP ASI (1.642) remain the strongest; MITRE ATLAS drops to 1.532, reflecting its emphasis on design-time threat identification over runtime defense. D. Top Three Most Mature Frameworks Based on composite scoring (60% normalized average score, 40% coverage breadth), three frameworks emerge as most mature for agentic AI security: (1) OWASP Agentic Security Initiative (composite 0.500, avg 1.798, coverage 65.3%). OWASP ASI is the only reviewed framework purpose-built for agentic systems. Its ten ranked risk categories (ASI01–ASI10) directly address agentic threat patterns—intent validation, per-tool least privilege, memory content validation, cryptographic inter-agent authentication, and behavioral monitoring. It achieves the highest score-3 count (28 items, 14.5%) and leads all frameworks in design- phase coverage. (2) CDAO Generative AI Responsible AI Toolkit (compos- ite 0.449, avg 1.668, coverage 62.2%). CDAO GenAI provides the most operationalized coverage through explicit tool man- dates (NeMo Guardrails, GARAK, RAGAS, Arize Phoenix, WhyLabs) embedded in a seven-stage lifecycle with RAI Gate checkpoints. It leads all frameworks in both development- phase and operational-phase coverage. (3) ATFAA-SHIELD (composite 0.445, avg 1.653, cov- erage 62.2%). ATFAA-SHIELD provides the most architec- turally specific defenses among non-OWASP frameworks, targeting the agentic properties that drive security risk: au- tonomous reasoning, persistent memory, dynamic tool in- tegration, and minimal oversight. Its six SHIELD control strategies achieve the highest score-2 density of any framework (114 items, 59.1%). E. Common Weak Points Across Frameworks Non-Determinism (RND, avg 1.231) is the weakest cat- egory by a clear margin. Most frameworks assume de- terministic threat models; the stochastic behavior intrinsic to LLM inference—session-state variability, MCTS planning non-determinism, HTN planning divergence—has no estab- lished countermeasure catalog in any reviewed framework. Data Leakage (RDL, avg 1.340) is second weakest, with sub- categories for streaming token-level leakage, GPU memory internals, load-balancer traffic analysis, and MCTS inference timing receiving minimal coverage. Trust Exploitation (RTE, avg 1.369) is third, as many sub-threats involve emergent multi-agent coordination behaviors without established miti- gations. Five items receive a maximum score of 1 across all 16 frameworks—no framework provides even indirect coverage: • RATC 10 — Efficiency Optimization and Resource Con- straint Exploitation • RDL29 — Data Leakage via MCTS Planning State • RND 25 — HTN Planning Non-Determinism • RND26 — MCTS Planning Non-Determinism • RTE 33 — Other Multi-Agent Trust Exploitation Risks These items involve algorithmic properties of advanced planning architectures (MCTS, HTN) or hardware-level re- source interactions that current frameworks neither model as threats nor prescribe mitigations for, representing the frontier where future framework development is most urgently needed. DISCLAIMER The field of agentic artificial intelligence is evolving at an exceptional pace. This document reflects the state of knowledge at the time of writing and may be superseded by subsequent developments. Readers should treat specific technical details as time-bounded and consult current primary sources before making security decisions. The threats, risks, and vulnerabilities cataloged in this work were identified through structured threat modeling ap- plied to technical descriptions of multi-agent AI System ar- chitectures. Threat modeling is an analytical and anticipatory activity: identified items represent plausible attack vectors derived from system properties and adversarial reasoning, and do not necessarily correspond to confirmed vulnerabilities in any specific product, active exploits observed in the wild, or security advisories issued by any vendor or government agency. No claim is made that any particular system, frame- work, or implementation is vulnerable to the threats described herein. This document constitutes an initial version of an ongoing research effort. Improved versions will be published on arXiv under the same title as the understanding of the agentic AI threat landscape matures, additional frameworks are surveyed, and new empirical evidence becomes available. This paper is provided for research and informational purposes only. The authors and Crew Scaler accept no liability for any outcomes—including security incidents, compliance decisions, procurement choices, or operational changes— arising from the application or interpretation of the contents of this document by any party. Readers are solely responsible for evaluating the applicability of this research to their own environments and for obtaining qualified security counsel before acting on any findings presented here. REFERENCES [1] V.Ciancaglini,M.Balduzzi,S.Gariuolo,R.Vosseler,and F.Tucci,“Theroadtoagenticainavigatingarchitecture, threats,andsolutions,”2025.[Online].Available:https: //w.trendmicro.com/vinfo/us/security/news/security-technology/ the-road-to-agentic-ai-navigating-architecture-threats-and-solutions [2] M. Corporation, “Microsoft 365 copilot,” Software application, 2026, aI-powered productivity tool integrating Word, Excel, PowerPoint, Outlook, and more. Available at: https://apps.microsoft.com/detail/ 9WZDNCRD29V9. [3] National Institute of Standards and Technology, “Artificial intelligence risk management framework (AI RMF 1.0),” National Institute of Standards and Technology, Tech. Rep. NIST AI 100-1, 2023. [Online]. Available: https://doi.org/10.6028/NIST.AI.100-1 [4] A. Vassilev, A. Oprea, A. Fordyce, H. Anderson, X. Davies, and M. Hamin, “Adversarial machine learning: A taxonomy and terminology of attacks and mitigations,” National Institute of Standards and Technology, Tech. Rep. NIST AI 100-2e2025, 2025. [Online]. Available: https://doi.org/10.6028/NIST.AI.100-2e2025 [5] MITRE Corporation, “MITRE ATLAS: Adversarial threat landscape for artificial-intelligence systems,” The MITRE Corporation, Tech. Rep., 2025, living knowledge base of adversarial ML tactics and techniques, Spring 2025 release. [Online]. Available: https://atlas.mitre.org/ [6] OWASP GenAI Security Project, “OWASP Top 10 for Agen- tic Applications 2026,” OWASP Foundation, Tech. Rep., 2026, agentic Security Initiative (ASI), https://genai.owasp.org/resource/ owasp-top-10-for-agentic-applications/. [7] V. S. Narajala and O. Narayan, “Securing agentic AI: A comprehensive threat model and mitigation framework for generative AI agents,” Amazon Web Services, Proactive Security, Technical Report, 2025, presents the ATFAA threat taxonomy (9 threats, 5 domains) and the SHIELD mitigation framework (6 control strategies). [Online]. Available: https://arxiv.org/abs/2504.19956 [8] Chief Digital and Artificial Intelligence Office, “Generative AI responsible AI toolkit, version 1.0,” U.S. Department of Defense, Chief Digital and Artificial Intelligence Office, Tech. Rep., Dec. 2024. [Online]. Available: https://w.ai.mil/Portals/137/Documents/ Resources%20Page/2024-12GenAI-Responsible-AI-Toolkit.pdf [9] P. Bryan, G. Severi, J. D. Gruyter, D. Jones, B. Bullwinkel, A. Minnich, S. Chawla, G. Lopez, M. Pouliot, A. Fourney, W. Maxwell, K. Pratt, S. Qi, N. Chikanov, R. Lutz, R. Sekhar, R. Dheekonda, B.-E. Jagdagdorj, E. Kim, J. Song, K. Hines, R. Lundeen, S. Vaughan, V. Westerhoff, Y. Zunger, C. Kawaguchi, M. Russinovich, R. Shankar, and S. Kumar, “Taxonomy of failure mode in agentic ai systems,” Tech. Rep. [10] H. J. Branch, J. R. Cefalu, J. McHugh, L. Hujer, A. Bahl, D. del Castillo Iglesias, R. Heichman, and R. Darwishi, “Evaluating the susceptibility of pre-trained language models via handcrafted adversarial examples,” 2022. [Online]. Available: https://arxiv.org/abs/2209.02128 [11] A. A. Sahili, A. Chehab, and R. Tajeddine, “On the effectiveness of membership inference in targeted data extraction from large language models,” 2026. [Online]. Available: https://arxiv.org/abs/2512.13352 [12] S. Gravitas, “Autogpt: A platform for building, deploying, and run- ning continuous ai agents,” GitHub repository, 2026, https://github.com/ Significant-Gravitas/AutoGPT (accessed 8 March 2026). [13] Y. Nakajima, “Babyagi: An experimental framework for self-building autonomous agents,” GitHub repository, 2023, urlhttps://github.com/yoheinakajima/babyagi (accessed 8 March 2026). [14] L. AI, “Langchain: The agent engineering platform,” GitHub reposi- tory, 2026, https://github.com/langchain-ai/langchain (accessed 8 March 2026). [15] Y. Gao, Y. Xiong, X. Gao, K. Jia, J. Pan, Y. Bi, Y. Dai, J. Sun, M. Wang, and H. Wang, “Retrieval-augmented generation for large language models: A survey,” 2024. [Online]. Available: https://arxiv.org/abs/2312.10997 [16] B. D. Sunil, I. Sinha, P. Maheshwari, S. Todmal, S. Mallik, and S. Mishra, “Memory poisoning attack and defense on memory based llm-agents,” 2026. [Online]. Available: https://arxiv.org/abs/2601.05504 [17] S. Hong, M. Zhuge, J. Chen, X. Zheng, Y. Cheng, C. Zhang, J. Wang, Z. Wang, S. K. S. Yau, Z. Lin, L. Zhou, C. Ran, L. Xiao, C. Wu, and J. Schmidhuber, “Metagpt: Meta programming for a multi-agent collaborative framework,” 2024. [Online]. Available: https://arxiv.org/abs/2308.00352 [18] C. Qian, W. Liu, H. Liu, N. Chen, Y. Dang, J. Li, C. Yang, W. Chen, Y. Su, X. Cong, J. Xu, D. Li, Z. Liu, and M. Sun, “Chatdev: Communicative agents for software development,” 2024. [Online]. Available: https://arxiv.org/abs/2307.07924 [19] J. Boes and F. Migeon, “Self-organizing multi-agent systems for the control of complex systems,” Journal of Systems and Software, vol. 134, p. 12–28, 2017. [Online]. Available: https: //w.sciencedirect.com/science/article/pii/S0164121217301838 [20] M. Lupinacci, F. A. Pironti, F. Blefari, F. Romeo, L. Arena, and A. Furfaro, “The dark side of llms: Agent-based attacks for complete computer takeover,” 2025. [Online]. Available: https: //arxiv.org/abs/2507.06850 [21] P. Reddy and A. S. Gujral, “Echoleak: The first real-world zero-click prompt injection exploit in a production llm system,” 2025. [Online]. Available: https://arxiv.org/abs/2509.10540 [22] P. He, Y. Lin, S. Dong, H. Xu, Y. Xing, and H. Liu, “Red-teaming llm multi-agent systems via communication attacks,” 2025. [Online]. Available: https://arxiv.org/abs/2502.14847 [23] J. Skalse, N. H. R. Howe, D. Krasheninnikov, and D. Krueger, “Defining and characterizing reward hacking,” 2025. [Online]. Available: https://arxiv.org/abs/2209.13085 [24] I. F. Shihab, S. Akter, and A. Sharma, “Detecting proxy gaming in rl and llm alignment via evaluator stress tests,” 2026. [Online]. Available: https://arxiv.org/abs/2507.05619 [25] MITRE Corporation, “SAFE-AI: A framework for securing AI,” The MITRE Corporation, Tech. Rep. MP250397, 2025. [Online]. Available: https://atlas.mitre.org/pdf-files/SAFEAI FullReport.pdf [26] V. S. Narajala, I. Habler, K. Huang, and P. Kulkarni, “Building a secure agentic AI application leveraging Google’s A2A protocol,” 2025. [Online]. Available: https://arxiv.org/abs/2504.16902 [27] NSA Artificial Intelligence Security Center, CISA, FBI, ASD’s ACSC, NCSC-NZ, and NCSC-UK, “AI data security: Best practices for securing data used to train & operate AI systems,” National Security Agency, Cybersecurity Information Sheet CSI U/O/157249- 25, May 2025. [Online]. Available: https://media.defense.gov/2025/ May/22/2003720601/-1/-1/0/CSIAIDATASECURITY.PDF [28] U.S. Government Accountability Office, “Artificial intelligence: An accountability framework for federal agencies and other entities,” U.S. Government Accountability Office, Tech. Rep. GAO-21-519SP, Jun. 2021. [Online]. Available: https://w.gao.gov/products/gao-21-519sp [29] OWASP GenAI Security Project, “Securing Agentic Applications Guide1.0,”OWASPFoundation,Tech.Rep.,2025,agentic SecurityInitiative(ASI),https://genai.owasp.org/resource/ securing-agentic-applications-guide-1-0/. [30] S. D ́ ıaz, C. Kern, and K. Olive, “An introduction to Google’s approachforsecureAIagents,”Google,TechnicalReport, 2025. [Online]. Available: https://services.google.com/fh/files/misc/ google-approach-secure-ai-agents.pdf [31] NationalInstituteofStandardsandTechnology,“AI600-1: Artificial intelligence risk management framework: Generative artificial intelligence profile,” National Institute of Standards and Technology, Tech. Rep. NIST AI 600-1, 2024, companion profile to the AI RMF 1.0 (NIST AI 100-1), released pursuant to Executive Order 14110. [Online]. Available: https://doi.org/10.6028/NIST.AI.600-1 [32] Defense Innovation Unit, “Responsible AI guidelines,” Web-based framework, 2022, operationalizes DoD AI Ethical Principles via Development and Deployment Worksheets covering Responsible, Equitable, Traceable, Reliable, and Governable pillars. [Online]. Available: https://w.diu.mil/responsible-ai-guidelines [33] DoD Chief Information Office, “DoD artificial intelligence cybersecurity risk management tailoring guide,” United States Department of Defense, Office of the Chief Information Officer, Tailoring Guide Version 2, Jul. 2025, in collaboration with the Office of the Under Secretary of Defense for Research and Engineering and the Office of the Under Secretary of Defense for Acquisition and Sustainment. [Online]. Available: https://dodcio.defense.gov/library/ [34] DoD Responsible AI Working Council, “Responsible artificial intelligence strategy and implementation pathway,” Office of the Chief Digital and Artificial Intelligence Officer, U.S. Department of Defense, Strategy and Implementation Pathway, Oct. 2024, updated October 2024; originally published June 2022. [Online]. Available: https://w.ai.mil/ [35] European Union Agency for Cybersecurity (ENISA), “Multilayer framework for good cybersecurity practices for AI,” European Union Agency for Cybersecurity (ENISA), Athens, Greece, Technical Report, Jun. 2023, framework for AI good cybersecurity practices (FAICP). [Online]. Available: https://w.enisa.europa.eu/publications/ multilayer-framework-for-good-cybersecurity-practices-for-ai [36] UK National Cyber Security Centre, Cybersecurity and Infrastructure Security Agency, National Security Agency, Australian Signals Directorate’s Australian Cyber Security Centre, Federal Bureau ofInvestigation,andCanadianCentreforCyberSecurity, “Guidelines for secure AI system development,” UK National CyberSecurityCentre,JointCybersecurityGuidance,2023, joint publication by NCSC-UK, CISA, NSA, ASD ACSC, FBI, CCCS, and sixteen additional international cyber agencies. Crown copyright 2023. [Online]. Available: https://w.ncsc.gov.uk/collection/ guidelines-secure-ai-system-development [37] National Security Agency Artificial Intelligence Security Center, Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, Australian Signals Directorate’s Australian Cyber SecurityCentre,CanadianCentreforCyberSecurity,New Zealand National Cyber Security Centre, and United Kingdom National Cyber Security Centre, “Deploying AI systems securely: Best practices for deploying secure and resilient AI systems,” NationalSecurityAgency,CybersecurityInformationSheet U/O/143395-24, Apr. 2024, version 1.0. Joint publication by NSA/AISC, CISA, FBI, ASD ACSC, CCCS, NCSC-NZ, and NCSC-UK.[Online].Available:https://w.nsa.gov/Press-Room/ Press-Releases-Statements/Press-Release-View/Article/3764/ nsa-and-partner-agencies-release-cybersecurity-information-sheet-on-deploying-a/ [38] M. Costa, B. K ̈ opf, A. Kolluri, A. Paverd, M. Russinovich, A. Salem, S. Tople, L. Wutschitz, and S. Zanella-B ́ eguelin, “Securing ai agents with information-flow control,” arXiv, May 2025. [Online]. Available: https://w.microsoft.com/en-us/research/ publication/securing-ai-agents-with-information-flow-control/ [39] Q. Yu, X. Cheng, and C. Liu, “Defense against indirect prompt injection via tool result parsing,” 2026. [Online]. Available: https: //arxiv.org/abs/2601.04795 [40] K. Hines, G. Lopez, M. Hall, F. Zarfati, Y. Zunger, and E. Kiciman, “Defending against indirect prompt injection attacks with spotlighting,” 2024. [Online]. Available: https://arxiv.org/abs/2403.14720 [41] X. Jiang, S. Yang, W. Yang, Y. Liu, and C. Ji, “Agentic ai as a cybersecurity attack surface: Threats, exploits, and defenses in runtime supply chains,” 2026. [Online]. Available: https://arxiv.org/abs/2602. 19555 [42] J. Mao, F. Meng, Y. Duan, M. Yu, X. Jia, J. Fang, Y. Liang, K. Wang, and Q. Wen, “Agentsafe: Safeguarding large language model-based multi-agent systems via hierarchical data management,” 2025. [Online]. Available: https://arxiv.org/abs/2503.04392 [43] C. P. Lee, D. Porfirio, X. J. Wang, K. C. Zhao, and B. Mutlu, “Veriplan: Integrating formal verification and llms into end-user planning,” in Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, ser. CHI ’25. ACM, Apr. 2025, p. 1–19. [Online]. Available: http://dx.doi.org/10.1145/3706598.3714113 [44] H. Shen, T. Knearem, R. Ghosh, K. Alkiek, K. Krishna, Y. Liu, Z. Ma, S. Petridis, Y.-H. Peng, L. Qiwei, S. Rakshit, C. Si, Y. Xie, J. P. Bigham, F. Bentley, J. Chai, Z. Lipton, Q. Mei, R. Mihalcea, M. Terry, D. Yang, M. R. Morris, P. Resnick, and D. Jurgens, “Position: Towards bidirectional human-ai alignment,” 2025. [Online]. Available: https://arxiv.org/abs/2406.09264

Instant research discovery