Paper deep dive
SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
Rui Yang, Junjie Xu, Zhengyu Liu, Neil Fendley, Yang Hong, Ziyang Li, Yinzhi Cao
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 9/2/2026, 5:26:33 AM
Summary
This Systematization of Knowledge (SoK) paper analyzes the security of Multi-Agent LLM Systems (MAS). It introduces an A-I-R framework (Adversary position -> Interaction Interface -> Risk) to trace attacks end-to-end. The authors analyze 197 works, identifying six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. They also propose a five-part defense contract and audit 44 evaluation works, highlighting challenges in isolating interaction effects and designing diagnostic metrics.
Entities (17)
Relation Signals (17)
Nanyang Technological University → affiliatedwith → Junjie Xu
confidence 98% · Junjie Xu² ... Affiliation: ² Nanyang Technological University
Johns Hopkins University → affiliatedwith → Rui Yang
confidence 98% · Rui Yang¹ ... Affiliation: ¹ Johns Hopkins University
A-I-R Framework → includescomponent → System-Level Risk
confidence 95% · We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk
A-I-R Framework → includescomponent → Adversary Position
confidence 95% · We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk
A-I-R Framework → includescomponent → Interaction Interface
confidence 95% · We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk
Adversary Position A3 → istypeof → Adversary Position
confidence 95% · An A3 member adversary controls one or more participating principals.
Adversary Position A4 → istypeof → Adversary Position
confidence 95% · An A4 infrastructure adversary controls shared components such as the coordinator, state store, router, telemetry service, or defense plane.
→ →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely multi-agent security effect. We thus systematize MAS security through an execution-centered analysis of 197 works, covering six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS. We organize defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identify path closure and recovery as key challenges. We audit 44 evaluation and benchmark works and identify open challenges in isolating interaction effects, designing comparable and diagnostic metrics, supporting reuse across MAS designs, and evaluating open-system operation. Together, these findings motivate an interaction-aware view of MAS security: trace attacks end to end, test whether defenses close those paths, and evaluate system-level effects with appropriate counterfactuals.
Tags
Links
- Source: https://arxiv.org/abs/2609.00595v1
- Canonical: https://arxiv.org/abs/2609.00595v1
Trouble viewing inline? Open PDF directly →
Full Text
129,352 characters extracted from source content.
Expand or collapse full text
SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems Rui Yang¹ Junjie Xu² Zhengyu Liu¹ Neil Fendley¹ Yang Hong¹ Ziyang Li¹ Yinzhi Cao¹ Affiliation: ¹ Johns Hopkins University ² Nanyang Technological University Affiliation: ryang54@jh.edu, andrexu736269@gmail.com, zliu192@jhu.edu, Affiliation: neil.fendley@jhuapl.edu, yhong51@jh.edu, ziyang@cs.jhu.edu, yinzhi.cao@jhu.edu Abstract Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely multi-agent security effect. We thus systematize MAS security through an execution-centered analysis of 197 works, covering six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS. We organize defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identify path closure and recovery as key challenges. We audit 44 evaluation and benchmark works and identify open challenges in isolating interaction effects, designing comparable and diagnostic metrics, supporting reuse across MAS designs, and evaluating open-system operation. Together, these findings motivate an interaction-aware view of MAS security: trace attacks end to end, test whether defenses close those paths, and evaluate system-level effects with appropriate counterfactuals. 1 Introduction Agents that are safe when used individually can fail when used together in a MAS. Benign prompt fragments can become harmful when combined [11]; truthful reports can steer a group toward a false belief [55]; and attacker-controlled content can pass through honest specialists to a privileged tool [62]. These failures arise through interactions among the separately addressable participants of the MAS, which we call principals. Messages propagate influence between principals, a shared state preserves propagated influence, aggregation combines local outputs from different principals, and delegation transfers authority across boundaries [79, 95, 93, 62]. We therefore study the end-to-end execution of MAS, where interactions may leave a failure largely unchanged, amplify it, create a failure through composition, or require defining a security property that exists only when principals interact. Figure 1: Unified execution view of MAS security. C1–C8 condition the execution. A1–A4 identify where adversarial influence begins, I1–I6 identify the transitions it crosses, and R1–R7 identify the resulting system-level failure. D1–D4 denote defensive control primitives applied along the execution. Existing surveys cover many important threats, approaching from different perspectives. Agent-security surveys organize risks around models, prompts, memory, tools, workflows, interfaces, and environments [34, 50, 181, 71], while MAS-focused surveys emphasize communication, trust, topology, governance, and collective behavior [49, 139, 72, 132]. What remains unclear is how an attack moves through a multi-agent system: where it enters, which interaction interfaces it uses, and what system-level security failure it finally causes. Without this execution view, simply observing a failure in a multi-agent setting can be mistaken for evidence that the failure depends on interaction. This distinction is increasingly important as the field grows, because closely related studies still use different threat models, units of analysis, metrics, and evidence standards. A common way to describe and evaluate these security effects is therefore needed. We address this gap by treating the complete multi-agent execution as the unit of analysis. Our core representation traces adversarial influence from its starting position (A), through one or more interaction interfaces (I), to a system-level security failure (R), yielding the A→I→RA→ I→ R framework. Eight configuration dimensions (C1–C8) describe the conditions under which such an execution occurs; they condition a path. Across the corpus, we group recurring A→I→RA→ I→ R executions into eight non-exclusive attack paths (P1–P8). These paths are synthesis shorthands for recurring execution patterns, not an additional taxonomy of security outcomes. The same execution view is then used to analyze where defenses can intervene and how security claims should be evaluated. Figure 1 summarizes this organization. Our contributions are therefore fourfold: • We define multi-agent security around end-to-end execution, providing a common basis for deciding when interaction matters to a security claim. This execution-centered view provides a common model for connecting system configuration, interaction paths, security effects, defenses, and evaluation. • We introduce the A→I→RA→ I→ R framework and synthesize seven system-level risk families and eight recurring attack paths. This structure follows adversarial influence from entry to consequence while showing how multiple risks and paths can compose within one execution. • We organize defenses with a five-part contract and map where each control primitive can interrupt an attack path. This exposes gaps in path closure, observer adequacy, intervention timing, mediation, and recovery. • We audit 44 evaluation and benchmark works and identify open problems in interaction-specific comparisons, designing comparable and diagnostic metrics, benchmark portability, and open-system evaluation. 2 Overview This section defines the scope of the SoK, positions our analysis relative to prior surveys, and summarizes the evidence base used for the synthesis. 2.1 Scope System boundary. We define an MAS by separately addressable principals: at least two participants whose outputs can affect one another through messages, shared state, collective decisions, or delegated actions [178, 56]. We call each such participant a principal. Principals may share the same LLM backend or use multiple models internally, so the system boundary is defined by interaction rather than model count [178, 71]. Debate systems, orchestrated teams, swarms, hierarchies, and A2A networks are therefore in scope when their participants act as separate principals [46, 86, 111]. Routing, ensembling, repeated sampling, and planner–critic–verifier pipelines are out of scope when all steps remain within one principal [71]. Security boundary. For the synthesis, we treat a result as evidence of a MAS-specific security effect when interaction changes a security-relevant outcome or when the protected property itself depends on interaction. Prompt injection, for example, may remain local, propagate across principals, persist in shared state, influence a collective decision, or gain authority through delegation [79, 95, 93, 62]. Authentication and authorization are likewise interaction-level concerns when trust or authority crosses principal boundaries [140, 173, 62]. Changes in accuracy, agreement, or behavior, including behavioral drift, count as security failures only when they violate a stated protected property or boundary. Results that reproduce an agent vulnerability in an MAS without a material interaction effect may be retained as comparative context, but they do not by themselves establish a MAS-specific causal claim. Interaction can play four roles in a security result. An inherited effect remains largely unchanged when the relevant relation is removed; we use this as a comparison label, not evidence of interaction dependence. An interaction-amplified effect remains possible, but interaction changes likelihood, reach, persistence, privilege, or impact [48, 182, 95, 151]. A composition-induced effect appears only when principals or steps are combined [11, 75, 124]. A structurally multi-agent effect concerns a property defined by relations among principals, such as collusion, coalition formation, or quorum manipulation [111, 105, 178]. For inherited, amplified, and composition-induced effects, relation-removal counterfactuals can distinguish whether the effect persists, changes in magnitude, or disappears when the protected property remains meaningful. Structurally multi-agent effects require comparisons that preserve the relation. These labels describe how interaction contributes to a security effect and what evidence is needed to support that claim. Work Interaction counterfactual End-to-end execution trace Threat–path– protected effect Defense assumptions Outcome-stage evidence Hammond et al. [49] Schroeder de Witt et al. [139] Sun et al. [144] Ko et al. [72] Raza et al. [132] Rafe et al. [129] Vangalapat et al. [153] Kale et al. [68] Tanveer [148] Kong et al. [73] Reid et al. [133] Shi et al. [140] Nguyen et al. [115] Ours Systematic Partial Not systematically treated Table 1: Coverage of prior multi-agent security syntheses across our analytical dimensions, using the coding criteria stated in Section 2.2. 2.2 Related Work Prior surveys, reviews, and synthesis-style studies cover complementary parts of agent and multi-agent security. Broad agent-security surveys organize threats and defenses around models, prompts, memory, tools, workflows, interfaces, and environments [34, 50, 71, 181]. MAS-focused syntheses study communication, trust, topology, coordination, authorization, governance, and system-level risks [49, 139, 144, 72, 73, 140, 132]. More focused or adjacent studies examine orchestration and verification, trustworthy coordination, privacy-preserving retrieval, governed risk analysis, and the coverage of existing security frameworks [129, 153, 68, 148, 133, 115]. These works have different goals and scopes, and we do not treat the comparison as a ranking of their quality. Our distinction is the unit of analysis. Rather than organizing security primarily by component, attack name, design pattern, or governance concern, we organize it around cross-principal execution. The same execution model connects where adversarial influence enters, which interaction interfaces it crosses, which protected system-level effect it reaches, where a defense can intervene and under what assumptions, and what evidence supports the claim. Table 1 compares prior syntheses along these analytical dimensions. We code a dimension as systematic only when it is used as an explicit organizing or evaluation axis, as partial when it is substantively discussed or illustrated but not applied systematically, and as not systematically treated otherwise. These markers describe analytical coverage, not the quality of the cited work. Literature Selection. We assembled the corpus through searches across major security, AI, and NLP venues and scholarly indexes, supplemented by backward and forward citation chasing. After deduplication and review against Section 2.1, the final corpus contains 197 works. We divide the corpus into two evidence sets with different roles in the synthesis. Set 1 contains 115 works that were peer reviewed or had received at least ten citations by the frozen review cutoff. We use these works to characterize the current MAS-security landscape and to support the main synthesis in the paper. Set 2 contains 82 additional in-scope works that point to emerging mechanisms, system settings, and security questions that may shape the next stage of the field. We use these works more selectively, primarily to highlight extensions of established attack paths, defenses, and evaluation settings. The literature corpus and associated artifacts will be released publicly with the final version of the paper. 3 System Model and Interaction Surface Building on the scope above, we separate the conditions around an execution from the transitions within it. Configuration dimensions (C1–C8) describe how the system is arranged and therefore condition the reach, persistence, and impact of an attack. Interaction interfaces (I1–I6) identify the security-relevant transitions through which information, state, decisions, authority, or security controls cross boundaries. The interfaces later form the middle of the A→I→RA→ I→ R execution path; the configuration dimensions provide context for interpreting that path. 3.1 Configuration Dimensions The eight configuration dimensions describe the conditions that shape an MAS execution. The same attack may therefore have different reach, persistence, or impact across configurations, and several dimensions may matter at once. C1: Communication topology. Communication topology describes which principals can communicate directly and which paths connect them. MAS studies commonly consider complete, chain or line, ring or circle, tree, and star topologies, as well as other system-specific communication graphs [48, 182, 166]. Topology changes path length, connectivity, and centrality, shaping how far adversarial influence can travel and which principals become important intermediaries. C2: Protocol semantics. Protocol semantics describe how principals exchange information and what security context is preserved across each exchange. MAS communication ranges from free-form natural-language messages to messages with fixed roles or formats and agent-to-agent protocols [86, 52, 62]. Security depends on whether identity, origin and provenance, task context, and authorization information remain available across principal boundaries. End-to-end enforcement may require the security context needed by downstream checks to remain available across the protocol chain. Each exchange may be valid on its own, yet the full execution can still become unsafe if translation, summarization, state updates, or delegation lose the origin, purpose, provenance, or authority needed by a later decision [62, 1]. C3: Principal composition. Principal composition describes which principals participate, what roles they play, and how independent they are. Systems may use homogeneous or heterogeneous models and generalist or specialist roles. Shared models, prompts, or evidence sources can create correlated behavior even when several principals participate [48, 105]. C4: Coordination mechanism. Coordination mechanisms describe how principals combine their contributions into a system-level decision or action. Common mechanisms include debate, voting, judge or aggregator models, consensus, and orchestrator-mediated coordination [93, 111, 55]. Their security depends on how malicious or correlated contributions affect the collective outcome. C5: State architecture. State architecture describes where state is stored, who can access it, and how long it persists. Distinctions include principal-local versus shared state, ephemeral versus persistent state, and whether state is copied or inherited across principals [95, 187, 21]. These choices determine which principals can read or modify state and whether derived state can later be traced, revoked, or repaired. C6: Membership and trust. Membership and trust describe which principals may participate and which relationships the system treats as trusted. Membership may be closed or open, static or dynamic, with persistent or ephemeral identities [86, 21, 89]. Dynamic systems must update admission, trust, and revocation as principals join, leave, or change roles. Membership is part of the system’s security state. In open or self-spawning systems, the population can change during execution, so the fraction of malicious principals is not necessarily fixed. Robustness claims based on that fraction therefore depend on how admission, identity, spawning, and revocation define who counts as a participant [21, 89]. C7: Authority placement. Authority placement describes which principals hold or can delegate privileged capabilities. Relevant authority includes tool permissions, credentials, resource budgets, delegation rights, and routing or control-plane privileges [62, 173, 1]. Security impact depends not only on which principals are reachable, but also on what authority is reachable through them. C8: Oversight architecture. Oversight architecture describes who can observe an execution and how much of it they can see. Monitoring may be local, distributed across principals, or centralized with graph or trace visibility. Broader visibility can improve detection and attribution, but it may also concentrate sensitive state and control in the oversight plane. A defense can only make claims about interactions that fall within its view. A local observer may miss behavior that spans edges, principals, shared state, or a long execution trace, while a broader observer may recover more of the path at the cost of stronger trust and privacy assumptions [162, 40, 193]. Limitations and Open Challenges. Configuration dimensions often change together. An architectural change may simultaneously alter topology, protocol behavior, state sharing, authority, and oversight [48, 95]. Security results should therefore state which C1–C8 dimensions vary across configurations. Controlled comparisons should isolate one dimension when possible and report coupled changes otherwise. More broadly, interaction does not always make a system less secure. The same architecture may increase or reduce risk under different models, protocols, roles, or protected properties. 3.2 Interaction Interfaces The six interaction interfaces mark security-relevant transitions during an MAS execution. I1–I5 describe how inputs, messages, state, authority, and collective decisions move through the system. I6 captures how the system observes and intervenes in those transitions. I1: Admission. Admission covers what is allowed to enter the MAS boundary, including users, new principals, external data, messages, and artifacts. Relevant context includes identity, provenance, role, initial trust, and participation rules [62, 86, 79]. An input that is safe at entry may still become harmful after later interactions give it more reach, persistence, or authority. I2: Message transfer. Message transfer begins once information moves between admitted principals. Security depends on who receives the message, in what order and context, and whether sender identity, provenance, and task purpose remain clear across the transfer [52, 176, 79]. Routing can therefore change which principals a message can influence. I3: State propagation. State propagation occurs when information from one interaction is written into state and later affects another principal or execution. This includes memories, summaries, plans, histories, and derived artifacts [95, 187, 21]. Unlike direct message transfer at I2, I3 can preserve and reintroduce influence after the original interaction has ended. I4: Authority transfer and action. Authority transfer and action cover delegation and use of privileged capabilities. A message, state update, or decision may lead a principal to use a tool, credential, resource, or delegated capability [62, 1, 36]. Security depends on whether the action stays within the authority, purpose, resource, and scope that were originally allowed. I4 therefore marks the transition from information or delegated authority to a privileged action; attacks exploit this interface when adversarial influence reaches that action. I5: Collective commitment. Collective commitment occurs when local outputs become a group-level decision, such as a vote, consensus, final answer, termination decision, or action trigger. Security depends on whether that decision is based on valid and sufficiently independent evidence [111, 55, 178]. Shared models, context, sources, or attacker influence can make agreement overstate the evidence. I6: Detection and intervention. Detection and intervention cover security checks and responses applied during an execution. These include monitoring, blocking, isolation, revocation, rollback, and recovery across I1–I5 [162, 40, 141]. A defense can act only on the information it can observe and the parts of the execution it can control. Intervention must also occur before the protected effect becomes irreversible when prevention is the goal. In short, C1–C8 are conditioning descriptors, whereas I1–I6 are transitions within an execution. Section 4 completes the execution record by adding the adversary position A and resulting risk R, forming A→I→RA→ I→ R. We reuse this single representation for attacks, defenses, and evaluation. 4 Attack Landscape Attacks become system-level failures when adversarial influence crosses interaction boundaries under a particular system configuration. We first define adversary positions and seven system-level risks, then synthesize eight recurring attack paths. We close with cross-cutting findings and the evidence gaps that remain for interaction-dependent harm. 4.1 Threat Model An MAS threat model must state the adversary’s position, capabilities, persistence, and the protected party and property. Figure 1 distinguishes four starting positions. An A1 external adversary controls content or services outside the MAS. An A2 user-level adversary acts through an authorized user interface. An A3 member adversary controls one or more participating principals. An A4 infrastructure adversary controls shared components such as the coordinator, state store, router, telemetry service, or defense plane. Adversary position alone does not determine capability. Attackers at the same position may differ in whether they can alter messages, routing, shared state, aggregation, membership, tools, or delegated authority [52, 176, 46, 93, 62]. Coalition size and persistence further shape how far that influence can propagate or coordinate [111, 105, 143]. A complete threat model must therefore specify not only where the adversary is, but also what it can control and which security property is protected. Limitations and Open Challenges. Many evaluated settings keep these variables fixed throughout a run, while deployed MAS may spawn principals, reroute communication, update trust, and delegate or revoke authority during execution. Threat models for such systems should track changes in membership, communication, state lineage, and reachable authority, rather than describe only the initial attacker state. In open or self-spawning systems, membership is itself part of the security state. Fraction-based robustness claims are incomplete unless admission and identity mechanisms define who counts toward the population and how spawned or ephemeral principals inherit trust [86, 21, 89, 173]. 4.2 System-Level Risk Families Risk families describe the system-level security failure reached by an attack. We group consequences into seven non-exclusive families. The same risk may arise through different interfaces, and one execution may trigger several risks. R1. Containment failure. Containment fails when adversarial influence escapes the principal or context in which it entered and remains effective elsewhere. Agent Smith, Prompt Infection, and the Wolf Within show spread across principals, while Flooding shows manipulated knowledge spreading and persisting through interaction and memory, and CORBA shows that blocking behavior can itself become contagious [46, 79, 147, 65, 195]. Topology and shared state determine how far that influence travels and whether it remains after the original source disappears [182, 95]. R2. Loss of independence. Loss of independence occurs when principals expected to provide independent evidence become strategically or statistically dependent. Secret Collusion and CoMet establish covert coordination channels, while hidden-role and steganographic studies show that such dependence may be difficult to observe [111, 172, 105, 170]. As illustrated in Fig. 2, protocol-valid messages can hide coordination between compromised principals, making their agreement unreliable as independent evidence. Dependence can also arise from a shared model, prompt, retriever, or poisoned source without explicit collusion. Agreement alone therefore does not establish independent support. Channel Monitorobserves the surface messagecannot recover hidden payload!Agent i!Agent j“looks benign”covert bits (hidden payload) Figure 2: Example: covert coordination. Two compromised principals use a protocol-valid message to coordinate covertly, so their apparent agreement cannot be treated as independent evidence. R3. Collective-decision integrity failure. Collective-decision integrity fails when adversarial influence changes a protected vote, consensus, commitment, quorum, or other group decision. Among Us studies malicious contributions, manipulation and persuasion attacks show how one member can steer otherwise benign participants, and Lying with Truths shows that individually truthful reports can still induce a misleading collective belief [178, 93, 76, 55]. The protected object is the group decision, not merely the correctness of each message. Path Typical A→I→RA→ I→ R Key C Primary evidence Emerging evidence P1. Admission / composition A1/A2 → I1/I2/I5 → R3/R6 C2/C4/C7 [79, 147, 152, 163, 124, 11, 75, 7, 9, 145] [127, 197, 74, 82, 92] P2. Propagation / persistence A1/A3 → I1/I2/I3 → R1 C1/C5/C6 [107, 46, 65, 79, 147, 195, 1, 128, 182, 95, 145] [197, 91, 187, 21, 37, 82, 156, 58] P3. Routing / role manipulation A3/A4 → I1/I2/I5 → R1/R3/R6 C1/C2/C3/C6 [70, 52, 176, 166, 182, 86, 36] [10, 32, 82, 143, 83, 37, 19] P4. Coordination / manipulation A3 → I2/I5 → R2/R3 C3/C4/C6 [111, 93, 172, 178, 75, 76, 55, 105, 170, 6, 117, 63, 150] [127, 32, 15, 5, 37, 137, 143, 94, 113, 78] P5. Peer / state steering A3 → I2/I3/I5 → R4 C3/C4/C5 Sparse; adjacent evidence [98, 76, 55, 106] [82, 19, 92] P6. Cross-principal leakage A2/A3/A4 → I2/I3/I4 → R5 C1/C5/C7 [111, 62, 172, 124, 166, 160, 174, 66, 17, 95, 145] [112, 171, 198, 14] P7. Delegation / authority A1/A3 → I2/I3/I4 → R6 C2/C6/C7 [62, 152, 163, 1, 128, 173, 36, 86, 120, 100] [197, 190, 91, 10, 187, 156, 112, 58, 21] P8. Resource / control plane A3/A4 → I2/I4/I6 → R7 C1/C7/C8 Sparse; direct evidence [195] [58, 96] Table 2: Representative evidence across recurring attack paths; C1–C8 denote conditioning configuration dimensions. R4. Trajectory and goal integrity failure. Trajectory or goal integrity fails when interaction redirects a protected objective, policy, or execution trajectory beyond an authorized boundary. CRDA measures content-risk drift under adversarial multi-agent interaction, while persuasion studies provide more direct evidence that peer interaction can redirect later behavior [98, 76]. FlowSteer studies workflow steering, while the LLM Drift software artifact provides an evaluation framework for behavioral drift and latent-state studies examine longer or stateful changes in multi-agent execution [82, 138, 19]. These forms of evidence do not all establish the same trajectory-security claim. Unlike ordinary accuracy degradation, an R4 claim needs an explicit protected objective and a boundary after which the deviation becomes unauthorized. Direct evidence for this risk remains thinner than for propagation or collective manipulation. R5. Cross-principal confidentiality breach. A cross-principal confidentiality breach occurs when protected information reaches an unauthorized principal, coalition, service, or observer. MASLeak studies extraction of multi-agent intellectual property, including prompts, tools, and architecture, while AgentLeak measures privacy leakage across internal coordination channels; CIA shows that communication topology itself can be inferred [160, 174, 166]. Compositional privacy further shows that several locally permissible views may reveal protected information when combined [124]. The protected object therefore extends beyond user secrets to internal context, state, workflow information, and system structure. R6. Transitive authorization failure. A transitive authorization failure occurs when state, instructions, or delegated authority cross principal boundaries and produce effects outside their original purpose or scope. Control-flow hijacking follows attacker-controlled influence through trusted handoffs into privileged tools, while cascading instruction and software-team attacks show similar composition across roles and artifacts [62, 1, 152, 163]. The central failure is loss of origin, purpose, or scope along the delegation chain [173]. R7. Availability and resource-isolation failure. Availability or resource isolation fails when shared communication, execution, or control resources allow one adversarial path to degrade the service available to other principals. CORBA provides direct evidence through contagious blocking [195]. Other studies expose resource and control-plane coupling, but systematic evidence for adversarial resource isolation remains limited. The defining property is cross-principal loss of availability or resource isolation, not ordinary latency, lower accuracy, or efficiency loss. Risk interactions. The risks can form chains rather than isolated outcomes. Propagation or persistent influence (R1) may redirect later behavior (R4), become accepted as collective evidence (R3), acquire delegated authority (R6), and eventually cross a confidentiality boundary (R5). Loss of independence (R2) can accelerate this chain, while resource interference (R7) can weaken observation or intervention at I6. This is a cross-paper synthesis rather than a claim that one study demonstrates the full chain. Limitations and Open Challenges. Risk labels identify consequences, not causes, and they should not be inferred from attack names alone. The same risk can arise through several interaction paths, while one execution can violate several protected properties at once. Evaluations should therefore state the protected property and verify the downstream consequence before assigning a system-level risk. 4.3 Attack Paths from Adversary to Risk Attack paths connect an adversary’s starting position to a security consequence through one or more interaction interfaces. Across the corpus, we identify eight recurring A→I→RA→ I→ R paths, summarized in Table 2. These paths describe recurring mechanisms, so one execution may contain several paths. Running example. Control-flow hijacking shows why the full execution matters. In our coding of CFH-Hard, the core path is A1 → I1 → I2 → I4: external content enters the system, is relayed through trusted principals, and reaches a privileged coder or emailer, causing an R6 authorization failure [62]. Replanning may also involve I3 when an intermediate plan or execution state persists into downstream execution. Each step may appear valid on its own: the input may be allowed, the intermediate task may look reasonable, and the delegated action may be valid for its immediate sender. The violation becomes clear only when provenance and authority are traced across the full execution. P1. Admission and compositional injection. Locally acceptable inputs can become unsafe when combined. Prompt Infection and the Wolf Within show malicious influence crossing principal boundaries, while conjunctive and semantic-intent fragmentation split unsafe intent across pieces that appear less suspicious on their own [79, 147, 11, 7]. Similar effects appear in software teams, RAG-based debate, and ACIARena, where prompts, retrieved content, or generated artifacts are combined later in the execution [152, 163, 75, 9]. Recent work extends this pattern to debate jailbreaks, distributed backdoors, multimodal injection, poisoned retrieval, and workflow steering [127, 197, 74, 82, 92, 118]. The common problem is that harmful meaning or authority may emerge only after several locally acceptable steps. Conjunctive Prompt Attacks directly isolates this compositional effect with single-fragment and combined-fragment controls [11]. P2. Propagation and persistence. Interaction can turn a local compromise into a system-wide or persistent failure. Agent Smith, Troublemaker, Flooding, Prompt Infection, the Wolf Within, and CORBA spread malicious influence or disruption through communication, retrieval, generated content, or agent state [46, 107, 65, 79, 147, 195, 183, 125]. NetSafe and memory studies further show that topology affects reach, while shared state affects persistence [182, 95, 185]. AgentWorm extends propagation across communication, state, and downstream actions, while When Child Inherits considers spawned principals and inherited state or authority [187, 21, 184, 104]. Propagation is therefore not only about message delivery. It also depends on what remains in the system after the original source is removed. Recovery is much less studied than spread, especially when memories, artifacts, delegations, or spawned principals remain after the initial compromise [95, 187, 21]. P3. Routing and role manipulation. The communication path itself can become an attack surface. Communication red teaming and MAST intercept or rewrite messages between principals without compromising endpoint models, while CIA treats topology itself as protected information [52, 176, 166, 188]. NetSafe shows how topology changes attack reach, A2ASecBench exposes protocol-stage attack surfaces, and PEAR highlights security effects of role separation [182, 86, 36]. Router hijacking, FlowSteer, and insider studies make routing and role placement explicit attack variables, while MESA identifies security-critical communication edges [10, 82, 143, 83, 168, 192]. Together, these studies show that routing and role placement can directly change decision influence and reachable authority. Many studies evaluate fixed membership, topology, and roles, leaving runtime admission, rerouting, and role reassignment less studied [86, 10, 82, 21]. P4. Adversarial coordination and collective manipulation. Collective security depends on independence, not only agreement. Secret Collusion and CoMet show covert coordination channels; Among Us measures malicious contributions; Lying with Truths shows how individually truthful statements can produce a misleading group conclusion; and persuasion and hidden role studies show how strategic members can steer a group [111, 172, 178, 55, 93, 76, 105, 57, 2, 110]. Other work studies adversarial majorities, coordinated insiders, debate jailbreaks, Byzantine communication, and consensus traps [15, 143, 127, 37, 94, 134]. Byzantine fault-tolerance studies further show that collective outcomes depend on assumptions about faulty membership and aggregation [191]; Fig. 3 illustrates the classical fault-bound intuition. A group may therefore agree strongly even when its evidence is compromised or not independent. It can also be hard to separate strategic coordination from common causes such as shared models, prompts, retrievers, or evidence sources [111, 55, 105, 135, 30]. This also limits content-only defenses: individually harmless messages can still create dependence through the communication channel, so message content alone cannot establish contributor independence [111, 172, 105]. A!B!B!Bconsensusvote / BFTpossible decision: Bsafety not guaranteedclassical fault threshold: f<n/3f<n/3f/n=3/7=0.43→f/n=3/7=0.43→ threshold exceeded Figure 3: Example: collective manipulation. With three malicious agents among seven, the classical Byzantine fault-tolerance condition f<n/3f<n/3 is not satisfied, so the classical guarantee no longer applies. P5. Peer- and state-mediated steering. P5 has limited direct evidence in our current map. CRDA measures content-risk drift under adversarial multi-agent interaction, while persuasion studies provide more direct evidence that peer interaction can redirect later behavior [98, 76]. FlowSteer and latent-state studies extend this analysis over longer or stateful executions [82, 19]. The LLM Drift software artifact provides an additional framework for measuring behavioral drift in adversarial multi-agent simulations [138]. Lower accuracy, changed reasoning, or generic drift does not by itself constitute an R4 failure. A study must identify the protected objective or allowed trajectory and show that interaction causes an unauthorized deviation. Direct evidence remains limited on when peer or state influence causes persistent, security-relevant goal redirection rather than temporary behavioral change [98, 82]. P6. Cross-principal information leakage. Confidentiality can fail during execution even when the final answer appears safe. MASLeak studies extraction of multi-agent intellectual property, including prompts, tools, and architecture, while AgentLeak measures privacy leakage across internal coordination channels; CIA shows that communication topology itself can be inferred [160, 174, 166]. Compositional privacy shows that several acceptable local views can reveal more when combined, and collusion studies show that inter-principal channels can hide strategic information transfer [124, 111]. Recent work studies distinct extensions: OMNI-LEAK examines orchestrator-mediated leakage, WebWeaver targets topology confidentiality, CalBench measures coordination–privacy trade-offs, and SNEAK evaluates strategic communication and information leakage [112, 171, 198, 14]. The protected object is therefore the information available to a principal or coalition across the execution, not only secret strings in the final response. Existing work gives limited attention to how ownership, provenance, receiver constraints, and intended use survive summarization, replication, joint inference, and tool use [124, 174, 95]. We found limited controlled evidence on cross-principal tool-prompt theft or timing, I/O, and network side channels. P7. Delegation and authority escalation. A locally valid handoff does not guarantee valid authority across the full execution. Control-flow hijacking traces attacker-controlled influence into privileged tools, while cascading instruction shows how upstream content can gain downstream authority. Multi-agent code-generation attacks show similar failures across specialized roles and generated artifacts [62, 1, 152, 163]. PEAR and A2ASecBench provide role- and protocol-aware views of these transitions [36, 86]. AgentWorm extends the path across communication, state, and downstream actions, while When Child Inherits considers spawned principals and inherited state or authority [187, 21]. The recurring failure is the loss of origin, purpose, or scope along the delegation chain. Defense work on Agentic JWT and SentinelAgent begins to address multi-hop delegation, but preserving intent, scope, and provenance across semantic transformation, and revoking authority after credentials, capabilities, or state have already propagated, remain open challenges [45, 123, 21]. P8. Shared-resource and control-plane interference. Shared resources create availability risks across principals. CORBA provides direct evidence of communication-level availability loss through contagious blocking [195]. Architectural-resilience and defection studies show that malicious or uncooperative participation can degrade shared execution, although such degradation does not by itself establish an R7 resource-isolation failure [130, 77]. Capability-paradox and sabotage evaluations show that defensive components can themselves change system-level security outcomes [96, 106]. This suggests that the defense plane can become part of the interaction surface, but systematic evidence on adversarial resource exhaustion and control-plane failure remains limited. Centralized control may improve visibility while also increasing the impact of a control-plane failure. Our current map contains relatively little direct security evidence for P8 compared with propagation and collective manipulation [195, 96, 106]. Path composition. A single execution may combine several paths. For example, malicious influence may enter through P1, persist through P2, alter a collective decision through P4, and finally reach a privileged action through P7 [79, 1, 62]. This composition shows why attacks should be traced across the full execution. 4.4 Cross-Cutting Findings Across P1–P8, four findings cut across individual attack mechanisms. First, relations are themselves attack surfaces: routing, role placement, aggregation, and delegation can change security even when message content is unchanged [52, 176, 10, 62]. Second, security effects can outlive the interaction that created them: shared state, spawned principals, and inherited authority can preserve a compromise after the original source is removed [95, 187, 21]. Third, the protected object extends beyond the final output: independence, topology, private context, and delegated authority can fail even when the final answer appears correct [111, 166, 174, 62]. Finally, observing an attack path is not the same as attributing its cause. Execution traces can show where harm travels, but additional comparisons are needed to establish which interaction caused or amplified it [182, 86, 9]. Together, these findings shift the security unit from an isolated malicious message or agent to the execution path that carries influence across principals. This distinction also determines what a defense must interrupt and what an evaluation must observe or vary to support a system-level security claim. 5 Defense Landscape The attack paths in Section 4.3 show how adversarial influence moves through an MAS. A defense may interrupt such a path by constraining the system before execution, intervening during execution, or containing and repairing effects after they occur. We therefore ask which path the defense targets, what it can observe, where and when it can intervene, what it must trust, and what recovery remains possible. Figure 1 shows the same execution from the defensive side. 5.1 Defense Contract We characterize each defense along five dimensions: path target, observation, intervention, trust boundary, and recovery. Because security effects may span several principals, a defense must account for how influence, state, and authority move through the execution. Path target. Which system-level risk or attack path must the defense interrupt? A claim should identify the risk R1–R7 and the interaction or path segment that must be broken. Protecting one agent or filtering one message is insufficient if the same effect remains reachable through another route. Observation. What part of the cross-principal execution can the defender observe? A defense may see a message, principal, communication edge, shared state, subgraph, latent state, or full execution trace. Observation depends mainly on oversight architecture C8 and which interfaces I1–I6 are visible. A defense cannot reliably detect a failure whose relevant interaction lies outside this view. Observation also varies in scope and depth: a local monitor may have detailed neighbor history, while a global monitor may cover more of the system through coarser logs or metadata [40, 119]. Intervention. What can the defender change, and when? A defense may reshape topology, policy, or authority before execution; block or rewrite messages, reroute communication, or quarantine principals during execution; or revoke authority and roll back shared state afterward. Timing matters: blocking a message before I2 may prevent a state change at I3 that is difficult to undo later. Trust boundary. Which principals, components, and system conditions must remain trustworthy? Examples include authenticated identities, trusted coordinators, preserved provenance, bounded membership, honest-neighbor or honest-majority conditions, stable topology, synchrony, and complete logs. Together, these assumptions define the defense’s effective trust boundary. Changes in membership, routing, delegation, or shared state can invalidate it during execution. Recovery. What remains when prevention or containment fails? Harmful influence may already have reached another principal, shared state, delegated authority, or a collective decision. A complete defense claim should state what can still be contained, revoked, rolled back, or repaired, and how the system verifies that the protected property has been restored. We use these five dimensions as a common comparison basis below. The control primitives describe what a defense acts on, while the contract describes how its protection claim is obtained and bounded. 5.2 Defense Control Primitives We organize existing defenses into four control primitives according to the main object they control in a multi-agent execution. These primitives are not mutually exclusive: one system may combine several of them. For each primitive, we compare its target paths, observation scope, intervention points, trust assumptions, and recovery limits. A smaller emerging literature instead asks where limited defensive capacity should be allocated across these control surfaces; we discuss this cross-cutting strategy separately below. Table 3 summarizes the comparison. ID Control primitive Configuration Interfaces Risks Primary evidence Emerging evidence D1 Identity / policy / authority enforcement C2/C6/C7/C8 I1/I2/I4/I6 R1/R5/R6 [29, 199, 85, 62, 136, 121] [45, 47, 123, 165, 126] D2 Trust / interaction-structure control C1/C3/C4/C6/C7 I2/I5/I6 R1/R2/R3/R6 [196, 191, 24, 26, 35, 84, 25, 97, 102, 51, 80] [157, 64, 161, 89, 18, 94, 22] D3 Detection / attribution / containment C1/C3/C5/C6/C8 I1–I6 Mechanism-specific [162, 109, 119, 53, 39, 193, 40, 130, 90, 164, 194, 141] [23, 101, 20, 154, 60, 3, 169, 59, 41, 175] D4 State / provenance / information-flow governance C2/C3/C5/C7/C8 I1/I2/I3/I4/I6 R1/R5/R6 [180, 146, 155, 4, 145, 87] [167, 108, 103, 13, 31, 149, 44, 142] Adaptive hardening / defense allocation C1/C3/C4/C8 I2/I4/I5/I6 R1/R3/R6 [186, 54, 120] [83] Table 3: Representative evidence for four defense control primitives and the cross-cutting adaptive allocation strategy. Risk mappings indicate the main protected effects addressed by the primitive; D3 coverage is mechanism-specific. D1. Identity, policy, and authority enforcement. D1 primarily interrupts admission and delegation paths (P1/P7) by controlling who may participate, what actions they may perform, and what authority may cross principal boundaries. Provenance controls can also help limit leakage along P6. Set 1 evidence includes identity and local-authorization mechanisms such as BlockA2A, decentralized identity and credential systems, SPIFFE-based authentication, SAFEFLOW, and ConvPayMAS [199, 136, 121, 85, 29]. They reduce reliance on message content alone by making identity, policy, and authorization explicit. Several Set 2 proposals extend these controls to multi-hop delegation, identity-aware routing, and context scoping. Agentic JWT binds authorization to user intent and workflow context, SentinelAgent targets intent-verified delegation chains, and LDP and Nexus add identity- or protocol-aware controls across principals [45, 123, 126, 47, 159, 122]. Set 1 control-flow work separately shows how downstream invocations can be restricted at execution time [62]. Recent work also broadens D1 with governance and context-level controls [27, 33, 165]. Across the defense contract, D1 observes identity, provenance, intent, and scope at admission and authorization boundaries, then constrains participation, actions, or delegated authority. Its guarantees depend on authenticated identities, mediated handoffs, and preservation of the security context needed by downstream checks. Revocation alone may not recover authority, credentials, or derived state that have already propagated. D2. Trust and interaction-structure control. D2 mainly targets routing and collective-manipulation paths (P3/P4) by changing who can influence whom and how collective evidence is combined. Topology control can also reduce propagation along P2. ResMAS and topology-linearization methods modify influence paths, while RoMa and trust-aware communication use credibility or trust signals to limit unreliable influence [196, 97, 84, 35]. AgentChain provides a separate coordination mechanism, while MIN-Trust restricts information disclosure across collaborating principals [25, 26]. Other Set 1 work studies faulty or Byzantine members and changes how collective evidence is aggregated [191, 24, 88]. D2 also includes dynamic-trust mechanisms such as DynaTrust, A-Trust, and Ev-Trust, which update influence from interaction history or message signals [89, 51, 157]. A separate line changes the collective-decision rule itself through local coordination, Byzantine protocols, conformal social choice, majority-resistant aggregation, or institutional controls [102, 22, 64, 161, 94, 16, 80, 18]. D2 therefore intervenes by changing communication, contributor influence, or aggregation. Its guarantees depend on assumptions about identity, membership, fault bounds, observability, and sometimes synchrony. Reconfiguring trust or topology can limit future influence, but does not by itself remove manipulated evidence already committed to persistent state or collective decisions. D3. Detection, attribution, and containment. D3 observes harmful influence and intervenes once suspicious behavior or propagation is identified. It applies across several attack paths, with much of the current evidence centered on propagation, routing, and collective manipulation (P2–P4). G-Safeguard, BlindGuard, XG-Guard, SentinelAgent, PeerGuard, GUARDIAN, and SentinelNet use communication structure, message or response signals, peer history, or anomaly scores to identify harmful participants [162, 109, 119, 53, 39, 193, 40]. Several recent works consider propagation rather than only suspicious endpoints. Cross-Layer Semantic Flow Reconstruction, CASPIAN, From Spark to Fire, INFA-Guard, PropGuard, contribution-based methods, and related cascade defenses study how harmful influence moves across messages, principals, or communication paths [20, 154, 169, 194, 175, 164, 41]. Other mechanisms target narrower intervention points, including misinformation rectification, sentence-level repair, linguistic routing controls, stubborn-neighbor detection, and game-theoretic or machine-checkable controls [90, 99, 8, 3, 59, 60, 177, 61, 67]. SAIGuard moves intervention earlier by predicting the state change caused by a candidate message and intercepting it before delivery [141]. More broadly, D3 ranges from local message or peer history to graph- and trace-level observation, with guarantees bounded by the coverage and integrity of that telemetry [119, 40]. Detection and containment do not imply recovery: once P2 has changed downstream state, stopping further spread does not undo earlier effects. D4. State, provenance, and information-flow governance. D4 controls what information and derived state may cross principal boundaries, where they may persist, and what security context remains attached to them. It therefore most directly addresses propagation, leakage, and delegation (P2/P6/P7). Set 1 evidence includes differential-privacy and privacy-preserving systems that limit disclosure across collaborating principals, together with provenance-aware work on cross-agent information flows [180, 43, 4, 146]. Set 1 also includes memory-oriented defenses such as Self-Healing Memory Architectures [155]. Set 2 work targets additional forms of shared and latent state, including Governed Shared Memory and EquiMem [103, 108]. PRISM models leakage that accumulates across multi-stage generation and intervenes before a complete secret is emitted, while LCGuard targets information carried through shared latent or KV state [149, 13]. Maris applies reference monitors and checked policies to declared cross-principal message and tool flows, while semantic-taint mechanisms attach tracking information to derived data [31, 142]. Other work combines information governance with prompt-injection controls, verifiable coordination, or contextual privacy mechanisms [44, 145, 167, 87]. D4’s guarantees are strongest when the relevant flow is mediated and its security context remains trustworthy. Maris, for example, assumes relevant message and tool flows pass through its reference monitors [31], while PRISM and latent-state defenses cover different leakage channels [149, 13]. Semantic rewriting, covert channels, and unmediated side effects remain harder to govern, and recovery requires tracing state that has already been copied or transformed. Adaptive defense allocation. The four primitives above describe what a defense controls. A smaller emerging literature asks where limited defensive capacity should be concentrated. SafeSieve progressively prunes communication, while MESA prioritizes communication edges according to estimated security relevance [186, 83]. Adjacent adaptive-hardening work uses randomized smoothing or adversarial co-evolution to improve robustness [54, 120]. These approaches can concentrate stronger protection on interactions that dominate propagation (P2), collective influence (P4), or downstream authority (P7), rather than applying the same control everywhere. We treat adaptive allocation as a cross-cutting strategy rather than a fifth control primitive because it selects where existing controls should be strengthened rather than defining a distinct object of enforcement. Its smaller evidence base also leaves open how well allocation signals transfer across tasks, models, topologies, and attack strategies. 5.3 Cross-Cutting Findings Comparing the defense literature through the contract above reveals three cross-cutting limitations that are not specific to any one control primitive. First, local protection does not imply path closure. Attack paths can compose: an attack may enter through P1, persist through P2, and gain authority through P7. A defense that blocks one transition therefore does not establish end-to-end protection when another route remains reachable. The mappings in Table 3 identify where a control may interrupt a path, not whether it closes every route to the protected effect. Second, defense effectiveness depends on where and when control is applied. Some defenses constrain the system before execution, while runtime defenses must observe enough of the relevant execution to support their intervention. A global observer may cover more of the execution but rely on coarse or trusted telemetry, while a local observer may see detailed behavior along only a small part of the path [40, 119]. Timing also determines what can still be prevented or reversed: ResMAS changes interaction structure before execution, SAIGuard can block candidate messages before delivery, while other mechanisms intervene after suspicious influence has been observed [196, 141, 119]. Defense guarantees therefore depend on the intervention point and, for runtime mechanisms, on whether their observation and control are sufficient for the claimed protection, together with the trust assumptions on which those mechanisms rely. Finally, containment is not recovery. Removing the source or stopping further propagation does not restore the system once its effects have been copied into memory, artifacts, credentials, delegated authority, or spawned principals [95, 187, 21]. Recovery requires identifying these descendants, revoking inherited authority, repairing state, and verifying that the protected property has been restored. In our map, recovery is evaluated less directly than prevention and containment. Together, these findings suggest that end-to-end MAS defense requires more than a strong local control: defenses must close the relevant attack paths, place interventions at points where they can affect those paths, provide adequate observation when runtime decisions depend on it, and account for residual effects that survive the original compromise. 6 Benchmarks and Evaluation Beyond mapping the attack and defense landscape, we examine how the security of multi-agent systems is evaluated. We first systematize existing benchmarks and their accompanying artifacts. We then identify four gaps in current evaluation practice and discuss the corresponding open challenges. 6.1 Existing Benchmarks and Artifacts Within the 197-work corpus, we identify 44 works whose main contribution is the security evaluation of multi-agent systems. These works test attacks, defenses, and security properties under different system designs and threat models. We reviewed the paper PDFs for 43 works and the software archive for one Zenodo record without an accompanying paper. For each work, we record its adversary position A1–A4, configuration dimensions C1–C8, interaction interfaces I1–I6, attack paths P1–P8, and system-level risks R1–R7. We also record their baselines, metrics, observation depth, and artifact availability. All counts below cover the full set of 44 works; the detailed per-work mapping is provided in Table 4. The works provide broad coverage of both attacks and defenses. Forty-two evaluate an attack or failure, including 16 that also evaluate a defense. CalBench and MAGPIE evaluate privacy without an explicit attacker [198, 66]. The benchmarks also cover many MAS designs. All 44 report or vary principal composition (C3), 39 cover coordination (C4), and 38 cover communication topology (C1). Membership is fixed in 42 works, while two allow limited runtime spawning. Member adversaries (A3), message transfer (I2), detection (I6), peer or state steering (P5), and collective-decision failure (R3) are the most common settings [182, 95, 9, 69]. The evaluations provide different depths of execution evidence. Classified by their deepest observation, 20 use full traces, 20 use principal-level messages or actions, two use episode outcomes, and two use final outputs. Thirty-one works identify code, data, logs, a test tool, or a project page, including 26 with an exact URL. The works also report communication topology for 38 works, model information for 32, and an exact principal count for 18. Summary. The 44 works evaluate diverse MAS designs and security questions, with varied observation depth and artifact support. 6.2 Gaps and Open Challenges Our analysis identifies four gaps in current evaluation practice. First, evaluations often show that a failure occurs without isolating how multi-agent interaction affects it. Second, metric names may hide what is measured, while execution traces rarely support causal diagnosis. Third, comparisons within one benchmark do not by themselves provide configurable or extensible components for other MAS designs. Finally, current evaluations largely focus on fixed, closed systems rather than practical open settings. 6.2.1 Isolating Multi-Agent Effects Determining how interaction changes a security outcome remains an open evaluation challenge. As defined in Section 2.1, a failure may remain unchanged without interaction, become worse because of interaction, appear only because of interaction, or involve a security property that exists only among multiple principals. Distinguishing these four roles requires comparisons designed for the specific role being tested. When an attack has a single-principal counterpart, a matched single-principal comparison can distinguish an inherited effect from an interaction-amplified effect. Our audit identifies 21 works that evaluate at least one of these two effects. Six compare an MAS with a single-principal execution [12, 92, 58, 189, 174, 128]. The remaining 15 evaluate the attack in an MAS or compare different MAS configurations. These evaluations show that the attack succeeds under the tested conditions, but they do not determine whether the same failure would occur with one principal or become worse through interaction. When no meaningful single-principal counterpart exists, the evaluation should preserve the MAS and vary the relation under study. Among 36 such works, 12 include a relation-focused comparison. The remaining 24 use another control or provide no clear relation-focused comparison. For example, MESA removes or masks communication edges, while CalBench compares models and coordination protocols under the same private-information constraints [83, 198]. Summary. Interaction-specific comparison remains an open evaluation challenge. Future benchmarks should match their comparison design to the interaction effect being tested. 6.2.2 Comparable and Diagnostic Metrics Current metrics are inadequate in two respects: their outcome-level measures are not comparable across benchmarks, and their trace-level measures do not explain how a compromise propagates across agents. Underspecified ASR. Attack Success Rate (ASR) is the most common security metric in our corpus. Thirteen of the 44 works compute ASR in their own evaluation, while ATAG additionally records ASR values reported by other sources [42]. Across these studies, ASR refers to different evaluation units and success conditions because the benchmarks study different attacks. The name “ASR” alone therefore does not identify what event is counted or over which eligible population. An ASR of 60% in one benchmark may therefore measure a different event from an ASR of 60% in another. The values cannot be directly compared, ranked, or aggregated unless these definitions match. When propagation is part of the claim, an end-to-end ASR also cannot distinguish an attack stopped at entry from one that spreads across several agents before being blocked. Future benchmarks should qualify ASR by its evaluation unit, using names such as per-principal ASR, per-message ASR, or per-run ASR, and define the counted success event. Each result should provide its taxonomy mapping, evaluation unit, execution protocol, and verification method. When propagation is part of the claim, stage-level measures should follow the relevant I1–I6 path to the verified R1–R7 consequence. These stages should be selected based on the attack rather than imposed on every risk. Existing work already measures individual dimensions such as harm amplification, topology-dependent leakage, and internal-channel exposure [131, 95, 174]. Benign task utility should be reported separately from security outcomes. Missing Causal Provenance. Full execution traces provide more information than final-output evaluation, but they do not necessarily explain why a failure occurred. Twenty records use the full execution trace as their deepest observation. These traces may show that one principal received malicious information, another updated memory, and a third invoked a tool, without showing how these events depend on one another. Across the corpus, ATAG models attack dependencies and Agent-BOM reconstructs dependencies from executions [42, 81]. Agent-BOM is the only one of these 20 full-trace records coded as reporting an explicit dependency or provenance graph. This evidence is unnecessary for benchmarks that report only final outcomes, but it is needed for claims about propagation, responsibility, or defense placement. Benchmarks that make such claims should represent the relevant execution path as a provenance graph. Its nodes should identify the principals and events at the I1–I6 interfaces, including attacker-controlled inputs, messages, memory operations, tool results, delegation decisions, and security-sensitive actions. Its edges should record data, control, and delegation dependencies. The path should begin with the first adversarially influenced event or violated trust boundary and end with a verified R1–R7 consequence. Because a dependency graph does not prove causation, the claimed path should also be tested through controlled replay or ablation. Summary. Thirteen works compute ASR in their own evaluation, while ATAG additionally records ASR values reported by other sources. Twenty records use the full execution trace as their deepest observation, and Agent-BOM is the only one coded as reporting an explicit dependency or provenance graph. 6.2.3 Configurable and Extensible Benchmarks Thirty-nine of the 44 works compare two or more evaluation conditions. These comparisons include component or attack controls, defense controls, single-principal baselines, and relation-focused MAS comparisons. They support controlled variation within each study, but do not show whether benchmark factors can be changed independently or reused elsewhere. We call a benchmark configurable when its supplied factors can be changed independently and extensible when new components can be added through a documented interface. ACIARena defines interfaces for MAS implementations, attacks, defenses, and evaluation modules [9]. RiskLab provides configurable experiment components and a registry for adding risk detectors [63]. A2ASecBench uses an LLM-based adapter to apply attack descriptions to different A2A scenarios [86]. These benchmarks expose useful extension points, but their task, trace, attack, and verifier formats differ. Transferring a component between them would therefore require an additional adapter. Similarly, the 31 works with identified artifacts may provide access to code or data without making their components reusable. Because our audit does not systematically record interface reuse, we do not quantify how often such reuse occurs. Benchmarks intended for cross-system comparison should expose the factors named in their claims through documented interfaces. A paired test should change one factor while preserving the protected property and outcome definition. Differences between system interfaces should be handled through validated adapters. Each run should record four groups of information: the model specification, execution settings, environment state, and verifier version. Summary. Thirty-nine works compare conditions within their own benchmark, but these comparisons do not by themselves establish configurability or extensibility. Future cross-system benchmarks should use documented interfaces while preserving the same security goal and success condition. 6.2.4 Open-System Evaluation Current benchmarks primarily evaluate closed systems whose members and trust relationships are fixed before execution. Forty-two of the 44 works use fixed membership, while the other two allow limited runtime spawning under one administrator. Ten works use deception games or negotiation environments, and many others rely on synthetic tasks with predefined roles. These settings support controlled experiments but do not capture how practical MAS operate across changing trust boundaries. Identity, trust, authority, and policy also matter in closed systems. However, they become more dynamic and consequential when previously unknown principals interact across administrative boundaries [72, 139]. Current benchmarks largely begin after these relationships have been established. They therefore provide little evidence about how principals enter the system, how trust changes during execution, or how access is removed. Future benchmarks should evaluate deployed coordination protocols and frameworks with independently managed principals. Testbeds should include heterogeneous implementations, persistent state, external services, and changing membership. They should cover the lifecycle from discovery and admission through operation and removal. Security outcomes should reflect consequences across real trust boundaries rather than only success or failure in a synthetic task. Summary. Forty-two works use fixed membership, while two allow limited spawning under one administrator. Evaluating changing membership and cross-domain trust remains an open benchmark problem. 7 Conclusion This SoK frames multi-agent LLM security around end-to-end execution. Across 197 works, we organize MAS security through system configuration, interaction interfaces, attack paths, defenses, and evaluation. Our analysis shows that security depends on how adversarial influence crosses principal boundaries, what state and authority remain reachable, whether defenses can close the path, and whether evaluations verify the resulting system-level effect. This execution-centered view provides a common basis for comparing security claims across MAS designs. Ethical Considerations This SoK synthesizes publicly available research on the security of multi-agent systems. It does not involve human-subject studies, private user data, or experiments against live or third-party systems. Our analysis is based on published papers, public artifacts, advisories, and bibliographic metadata. The topic is inherently dual use: organizing attack mechanisms and system weaknesses can help both defenders and attackers understand where multi-agent systems fail. We therefore emphasize security properties, interaction paths, threat assumptions, defenses, and evaluation evidence rather than operational payloads or step-by-step exploitation procedures. We do not disclose non-public vulnerabilities or unnecessary identifying details. Finally, we distinguish experimental evidence from deployment prevalence. A vulnerability demonstrated in a benchmark or controlled environment does not by itself imply that the same failure is common in deployed systems. We report claims within the scope and assumptions supported by the underlying studies. Open Science The literature corpus and associated artifacts will be released publicly with the final version of the paper. Acknowledgement Research reported in this publication was supported by an Amazon Research Award, Fall 2025, and by the 2026 Amazon Nova AI Challenge: Trusted Software Agents. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies of the supporting sponsors. References [1] M. R. M. Abdellah and A. S. Aziz (2026) Cascading instruction influence: a simulation-based analysis of indirect prompt injection in hierarchical multi-agent systems. Statistics, Optimization & Information Computing 15 (6), p. 5445–5458. External Links: Document, Link Cited by: §3.1, §3.1, §3.2, §4.2, §4.3, §4.3, Table 2, Table 2. [2] S. Abdelnabi, A. Gomaa, S. Sivaprasad, L. Schönherr, and M. Fritz (2024) Cooperation, competition, and maliciousness: llm-stakeholders interactive negotiation. In NeurIPS 2024, Vol. 37. External Links: Document, Link, 2309.17234 Cited by: Table 4, §4.3. [3] S. Abedini, S. Mavali, L. Schönherr, M. Pawelczyk, and R. Burkholz (2026) Don’t trust stubborn neighbors: a security framework for agentic networks. In arXiv.org, External Links: Document, Link, 2603.15809 Cited by: §5.2, Table 3. [4] C. Agarwal, N. Erukulla, and R. Gupta (2026) Privacy-preserving LLM infrastructure with multi-agent orchestration and RAG-driven retrieval. Journal of International Crisis and Risk Communication Research, p. 133–140. External Links: Document, Link Cited by: §5.2, Table 3. [5] M. Agarwal and D. Khanna (2025) When persuasion overrides truth in multi-agent llm debates: introducing a confidence-weighted persuasion override rate (cw-por). Note: arXiv preprint arXiv:2504.00374 External Links: Link Cited by: Table 2. [6] M. Agarwal, S. Rana, T. Sundoro, H. Berhe, S. Kim, V. Sharma, S. O’Brien, and K. Zhu (2025) WOLF: werewolf-based observations for LLM deception and falsehoods. In NeurIPS 2025 Workshop on Multi-Turn Interactions in Large Language Models, Note: arXiv External Links: Link, 2512.09187 Cited by: Table 4, Table 2. [7] T. Ahad, I. Hossain, M. J. Alam, S. Puppala, Y. Lee, S. B. Alam, and S. Talukder (2026) Semantic intent fragmentation: a single-shot compositional attack on multi-agent AI pipelines. AAAI Symposium Series 9 (1), p. 229–237. External Links: Document, Link, 2604.08608 Cited by: §4.3, Table 2. [8] D. Alsheich, A. Peleg, B. Hagag, R. Himelstein, A. Levi, and A. Mendelson (2026) Linguistic firewall: geometry as defense in multi-agent systems routing. Note: arXiv External Links: Document, Link, 2606.30555 Cited by: §5.2. [9] H. An, M. Li, J. Zhang, N. Xu, C. Zhou, C. Li, X. Xu, T. Du, and S. Ji (2026) ACIARena: toward unified evaluation for agent cascading injection. In ACL, p. 10049–10066. External Links: Document, Link Cited by: Table 4, §4.3, §4.4, Table 2, §6.1, §6.2.3. [10] S. Andric (2025) LLM hijacking: when models manipulate their routers. Note: Zenodo External Links: Document, Link Cited by: §4.3, §4.4, Table 2, Table 2. [11] N. H. Arif, Q. Lou, and M. Zheng (2026) Conjunctive prompt attacks in multi-agent llm systems. In ACL, p. 34175–34191. External Links: Document, Link, 2604.16543 Cited by: §1, §2.1, §4.3, Table 2. [12] N. Arora, S. Joel, I. Kavathekar, Palak, R. Gandhi, Y. Pandya, T. Ganu, A. Kanade, and A. Nambi (2026) Exposing weak links in multi-agent systems under adversarial prompting. In AAMAS 2026 Strategic Engineering Workshop, External Links: Link Cited by: Table 4, §6.2.1. [13] S. Asif, M. M. Amiri, M. Abbas, P. Sattigeri, and K. N. Ramamurthy (2026) LCGuard: latent communication guard for safe KV sharing in multi-agent systems. Note: arXiv preprint arXiv:2605.22786 External Links: Document, Link Cited by: §5.2, Table 3. [14] A. Avsian and L. Heck (2026) SNEAK: evaluating strategic communication and information leakage in large language models. Note: arXiv preprint arXiv:2603.29846 External Links: Link Cited by: Table 4, §4.3, Table 2. [15] A. Bashir, T. A. Han, and Z. Ush-Shamszaman (2025) Many-to-one adversarial consensus: exposing multi-agent collusion risks in ai-based healthcare. Note: arXiv preprint arXiv:2512.03097 External Links: Link Cited by: §4.3, Table 2. [16] S. Bhattacharya (2026) Consensus-driven metacognition in multi-agent systems: a logic-based byzantine fault-tolerant protocol. International Journal of Global Innovations and Solutions 3 (4). External Links: Document, Link Cited by: §5.2. [17] M. Biswas, W. Yu, Q. Wang, and W. Liao (2025) Quantifying privacy leakage in multi-agent llms: a unified theoretical and empirical analysis. In BigData Congress [Services Society], p. 1685–1694. External Links: Document, Link Cited by: Table 4, Table 2. [18] M. Bracale Syrnikov, F. Pierucci, M. Galisai, M. Prandi, P. Bisconti, F. Giarrusso, O. Sorokoletova, V. Suriani, and D. Nardi (2026) Institutional AI: governing LLM collusion in multi-agent cournot markets via public governance graphs. Note: arXiv preprint arXiv:2601.11369 External Links: Document, Link Cited by: §5.2, Table 3. [19] L. Brito and C. Baquero (2026) When latent agents lie: kv-cache integrity in multi-agent llm collaboration. Note: arXiv preprint arXiv:2606.28958 External Links: Link Cited by: §4.2, §4.3, Table 2, Table 2. [20] Q. Cai, Y. Wei, Z. Chen, S. Ji, and Z. Li (2026) Cross-layer semantic flow reconstruction for attack detection in agentic systems. Note: arXiv preprint arXiv:2603.04469 External Links: Document, Link Cited by: §5.2, Table 3. [21] Z. Cai, Y. Zhang, and X. Hei (2026) When child inherits: modeling and exploiting subagent spawn in multi-agent networks. Note: arXiv preprint arXiv:2605.08460 External Links: Link Cited by: Table 4, §3.1, §3.1, §3.2, §4.1, §4.3, §4.3, §4.3, §4.4, Table 2, Table 2, §5.3. [22] N. Chadderwala (2025) Byzantine fault-tolerant multi-agent system for healthcare: a gossip protocol approach to secure medical message propagation. Note: arXiv preprint arXiv:2512.17913 External Links: Document, Link Cited by: §5.2, Table 3. [23] C. Chan, J. Yu, W. Chen, C. Jiang, X. Liu, W. Shi, Z. Liu, W. Xue, and Y. Guo (2024) AgentMonitor: a plug-and-play framework for predictive and secure multi-agent systems. Note: arXiv preprint arXiv:2408.14972 External Links: Document, Link Cited by: Table 3. [24] B. Chen, G. Li, X. Lin, Z. Wang, and J. Li (2024) BlockAgents: towards byzantine-robust LLM-based multi-agent coordination via blockchain. In ACM Turing Celebration Conference, p. 187–192. External Links: Document, Link Cited by: §5.2, Table 3. [25] B. Chen, G. Li, J. Wu, J. Li, M. Chen, and J. Wang (2026) AgentChain: blockchain-empowered multi-agent coordination for trustworthy LLM question-answering systems. IEEE Transactions on Dependable and Secure Computing 23 (4), p. 8501–8518. External Links: Document, Link Cited by: §5.2, Table 3. [26] J. Chen, F. Wang, T. Guan, Y. Ma, L. Yang, and Y. Wang (2026) MIN-Trust: a minimum necessary information trust orchestration framework for multi-agent collaboration. In GAIE 2026, External Links: Document, Link, 3808.38138 Cited by: §5.2, Table 3. [27] J. Chen, J. Yang, Z. Zeng, Z. Huang, J. Li, and Y. Wang (2025) SecureGov-agent: a governance-centric multi-agent framework for privacy-preserving and attack-resilient LLM agents. In Proceedings of the 2025 6th International Conference on Computer Science and Management Technology, p. 875–881. External Links: Document, Link, 5154.37952 Cited by: §5.2. [28] K. Chen, T. Zhen, H. Wang, K. Liu, X. Li, J. Huo, T. Yang, J. Xu, W. Dong, and Y. Gao (2025) MedSentry: understanding and mitigating safety risks in medical LLM multi-agent systems. arXiv. External Links: Document, Link, 2505.20824 Cited by: Table 4. [29] J. K. Chua, C. H. Tse, D. Huang, and Z. Wang (2026) ConvPayMAS: conversational payment multi-agent system with agent-to-agent protocol and three-mandate verification. In Proceedings of the 25th International Conference on Autonomous Agents and Multiagent Systems, External Links: Document, Link Cited by: §5.2, Table 3. [30] R. Cosentino, S. Shekkizhar, and A. Earle (2025) Convergence dynamics of agent-to-agent interactions with misaligned objectives. Note: arXiv preprint arXiv:2511.08710 External Links: Document, Link Cited by: §4.3. [31] J. Cui, Z. Li, C. Wang, L. Xing, and X. Liao (2025) Maris: a formally verifiable privacy policy enforcement paradigm for multi-agent collaboration systems. Note: arXiv preprint arXiv:2505.04799 External Links: Document, Link Cited by: §5.2, Table 3. [32] Y. Cui and H. Du (2025) MAD-Spear: a conformity-driven prompt injection attack on multi-agent debate systems. Note: arXiv preprint arXiv:2507.13038 External Links: Document, Link Cited by: Table 2, Table 2. [33] J. de Curtò, I. de Zarzà, and C. T. Calafate (2026) Ethical coordination of LLM multi-agent systems. Electronics 15 (11), p. 2278. External Links: Document, Link Cited by: §5.2. [34] Z. Deng, Y. Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y. Xiang (2025) AI agents under threat: a survey of key security challenges and future pathways. ACM Computing Surveys. External Links: Document, Link Cited by: §1, §2.2. [35] Y. Ding, A. Twabi, J. Yu, L. Zhang, T. Kondo, and H. Sato (2025) Decentralized multi-agent system with trust-aware communication. In IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA), p. 1439–1445. External Links: Document, Link, 7752.2025 Cited by: §5.2, Table 3. [36] S. Dong, M. Zhang, P. He, L. Ma, B. Thuraisingham, H. Liu, and Y. Xing (2026) PEAR: planner-executor agent robustness benchmark. In Findings of the Association for Computational Linguistics: EACL, External Links: Document, Link, 2510.07505 Cited by: Table 4, §3.2, §4.3, §4.3, Table 2, Table 2. [37] A. El Mir, M. Takác, and S. Lahlou (2026) Byzantine cheap talk: adversarial resilience and topology effects in LLM coordination games. Note: arXiv preprint arXiv:2606.07790 External Links: Document, Link Cited by: §4.3, Table 2, Table 2, Table 2. [38] C. Fan, D. Tial, V. Dubrovenski, M. Zhang, Y. Lee, and D. Xu (2025) Security of llm agents: a case study approach. In International Conference on Trust, Security and Privacy in Computing and Communications, p. 1952–1957. External Links: Document, Link Cited by: Table 4. [39] F. Fan and X. Li (2025) PeerGuard: defending multi-agent systems against backdoor attacks through mutual reasoning. In IEEE International Conference on Information Reuse and Integration and Data Science (IRI), External Links: Document, Link, 6576.2025 Cited by: §5.2, Table 3. [40] Y. Feng and X. Pan (2026) SentinelNet: safeguarding multi-agent collaboration through credit-based dynamic threat detection. In the ACM Web Conference, External Links: Document, Link, 4904.37924 Cited by: §3.1, §3.2, §5.1, §5.2, §5.2, §5.3, Table 3. [41] N. Gamb (2026) Memetic cascade detection and symbolic immunity in multi-agent LLM systems. Note: Zenodo External Links: Document, Link Cited by: §5.2, Table 3. [42] P. A. Gandhi, D. Tayouri, A. Shukla, B. Ifland, Y. Elovici, R. Puzis, and A. Shabtai (2026) ATAG: ai-agent application threat assessment with attack graphs. In ACM Asia Conference on Computer and Communications Security, p. 805–819. External Links: Document, Link, 9208.37853 Cited by: Table 4, §6.2.2, §6.2.2. [43] P. K. Goel, S. P. Yadav, and M. Singh (2026) Security and privacy in multi-agent llm networks: addressing vulnerabilities. In Advances in computational intelligence and robotics book series, p. 225–244. External Links: Document, Link Cited by: §5.2. [44] D. Gosmar and D. A. Dahl (2026) Prompt injection mitigation with agentic AI, nested learning, and AI sustainability via semantic caching. Note: arXiv preprint arXiv:2601.13186 External Links: Document, Link Cited by: §5.2, Table 3. [45] A. Goswami (2025) Agentic JWT: a secure delegation protocol for autonomous AI agents. Note: arXiv preprint arXiv:2509.13597 External Links: Document, Link Cited by: §4.3, §5.2, Table 3. [46] X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y. Wang, J. Jiang, and M. Lin (2024) Agent smith: a single image can jailbreak one million multimodal LLM agents exponentially fast. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 235, p. 16647–16672. External Links: Link Cited by: §2.1, §4.1, §4.2, §4.3, Table 2. [47] S. Gupta (2026) Nexus protocol: a cryptographically secure, zero-latency semantic routing engine for multi-agent systems. Note: SSRN Electronic Journal External Links: Document, Link Cited by: §5.2, Table 3. [48] B. Hagag, W. L. Anderson, C. Schroeder de Witt, and S. Scheffler (2026) Architecture matters for multi-agent security. Note: arXiv preprint arXiv:2604.23459 External Links: Document, Link Cited by: §2.1, §3.1, §3.1, §3.1. [49] L. Hammond, A. Chan, J. Clifton, J. Hoelscher-Obermaier, A. Khan, E. McLean, C. Smith, W. Barfuss, J. Foerster, T. Gavenčiak, T. A. Han, E. Hughes, V. Kovařík, J. Kulveit, J. Z. Leibo, C. Oesterheld, C. Schroeder de Witt, N. Shah, M. Wellman, P. Bova, T. Cimpeanu, C. Ezell, Q. Feuillade-Montixi, M. Franklin, E. Kran, I. Krawczuk, M. Lamparth, N. Lauffer, A. Meinke, S. Motwani, A. Reuel, V. Conitzer, M. Dennis, I. Gabriel, A. Gleave, G. Hadfield, N. Haghtalab, A. Kasirzadeh, S. Krier, K. Larson, J. Lehman, D. C. Parkes, G. Piliouras, and I. Rahwan (2025) Multi-agent risks from advanced AI. Note: Cooperative AI Foundation Technical Report #1 External Links: Document, Link Cited by: §1, §2.2, Table 1. [50] F. He, T. Zhu, D. Ye, B. Liu, W. Zhou, and P. S. Yu (2025) The emerged security and privacy of llm agent: a survey with case studies. ACM Computing Surveys. External Links: Document, Link Cited by: §1, §2.2. [51] P. He, Z. Dai, X. Tang, Y. Xing, H. Liu, J. Zeng, Q. Peng, S. Agrawal, S. Varshney, S. Wang, J. Tang, and Q. He (2026) To trust or not to trust: attention-based trust management for LLM multi-agent systems. ACL. External Links: Document, Link, 2506.02546 Cited by: §5.2, Table 3. [52] P. He, Y. Lin, S. Dong, H. Xu, Y. Xing, and H. Liu (2025) Red-teaming llm multi-agent systems via communication attacks. In Findings of ACL, p. 6726–6747. External Links: Document, Link, 2502.14847 Cited by: §3.1, §3.2, §4.1, §4.3, §4.4, Table 2. [53] X. He, D. Wu, Y. Zhai, and K. Sun (2025) SentinelAgent: graph-based anomaly detection in multi-agent systems. Note: arXiv External Links: Document, Link, 2505.24201 Cited by: §5.2, Table 3. [54] J. Hu, Y. Dong, Z. Ding, and X. Huang (2026) Enhancing robustness of LLM-driven multi-agent systems through randomized smoothing. Chinese Journal of Aeronautics. External Links: Document, Link Cited by: §5.2, Table 3. [55] J. Hu, X. Huang, Y. Sun, Y. Dong, and X. Huang (2026) Lying with truths: open-channel multi-agent collusion for belief manipulation via generative montage. In ACL, p. 5979–5996. External Links: Document, Link, 2601.01685 Cited by: §1, §3.1, §3.2, §4.2, §4.3, Table 2, Table 2. [56] J. Huang, J. Zhou, T. Jin, X. Zhou, Z. Chen, W. Wang, Y. Yuan, M. R. Lyu, and M. Sap (2025) On the resilience of LLM-based multi-agent collaboration with faulty agents. In Proceedings of the 42nd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 267, p. 26202–26226. External Links: Link Cited by: §2.1. [57] K. Huang, Y. Wei, W. Wu, T. Zhang, Z. Yang, and L. Zhou (2026) Whispering agents: an event-driven covert communication protocol for the internet of agents. In AAAI, Vol. 40, p. 31185–31192. External Links: Document, Link, 2508.02188 Cited by: §4.3. [58] S. Jamshidi, A. Moradi Dakhel, K. W. Nafi, and F. Khomh (2026) Security engineering of OpenClaw: analyzing attack surface expansion and trust-boundary violations. Note: arXiv preprint arXiv:2606.15008 External Links: Document, Link Cited by: Table 4, Table 2, Table 2, Table 2, §6.2.1. [59] S. Jamshidi, A. Nikanjam, A. Moradi Dakhel, K. W. Nafi, and F. Khomh (2026) Game-theoretic multi-agent control for robust contextual reasoning in LLMs. Note: arXiv preprint arXiv:2606.10322 External Links: Document, Link Cited by: §5.2, Table 3. [60] S. Jamshidi (2026) Collective hallucination in multi-agent LLMs: modeling and defense. Note: arXiv preprint arXiv:2606.07941 External Links: Document, Link Cited by: §5.2, Table 3. [61] S. Jamshidi (2026) SGTO-MAS: secure gorilla troops optimization for multi-agent LLM systems. Note: arXiv preprint arXiv:2606.07940 External Links: Document, Link Cited by: §5.2. [62] R. Jha, H. Triedman, J. Wagle, and V. Shmatikov (2026) Breaking and fixing defenses against control-flow hijacking in multi-agent systems. In International Conference on Learning Representations, External Links: Link, 2510.17276 Cited by: §1, §2.1, §3.1, §3.1, §3.2, §3.2, §4.1, §4.2, §4.3, §4.3, §4.3, §4.4, Table 2, Table 2, §5.2, Table 3. [63] Y. Jiang, W. Wang, Y. Huang, Y. Wang, Z. Zhou, X. Chen, Y. Liu, P. Chen, W. Wang, and X. Zhang (2026) RiskLab: a controlled toolkit for probing emergent risks in LLM-based multi-agent systems. In ACL System Demonstrations, External Links: Document, Link Cited by: Table 4, Table 2, §6.2.3. [64] Y. Jo and C. Park (2025) Byzantine-robust decentralized coordination of LLM agents. Note: arXiv preprint arXiv:2507.14928 External Links: Document, Link Cited by: §5.2, Table 3. [65] T. Ju, Y. Wang, X. Ma, P. Cheng, H. Zhao, Y. Wang, L. Liu, J. Xie, Z. Zhang, and G. Liu (2026) Flooding spread of manipulated knowledge in llm-based multi-agent communities. Science China Information Sciences. External Links: Document, Link, 2407.07791 Cited by: §4.2, §4.3, Table 2. [66] G. Juneja, J. N. S. Pasupulati, A. Albalak, W. Hua, and W. Y. Wang (2025) MAGPIE: a benchmark for multi-agent contextual privacy evaluation. In NeurIPS Workshop on Socially Responsible and Trustworthy Foundation Models, External Links: Link, 2506.20737 Cited by: Table 4, Table 2, §6.1. [67] R. K. Kadaboina (2026) Pratyahara: a neural tissue defense model for detecting compromised agents in multi-agent networks. Note: Zenodo External Links: Document, Link Cited by: §5.2. [68] J. R. Kale, H. S. Jain, A. R. Korwar, and K. A. Jojare (2026) A literature survey on privacy-preserving multi-agent RAG systems with an intelligent tag-inference routing system. International Research Journal of Modernization in Engineering Technology and Science 8 (5). External Links: Document, Link Cited by: §2.2, Table 1. [69] I. Kavathekar, H. Jain, A. Rathod, P. Kumaraguru, and T. Ganu (2026) TAMAS: benchmarking adversarial risks in multi-agent LLM systems. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, p. 31238–31268. External Links: Document, Link, 2511.05269 Cited by: Table 4, §6.1. [70] R. M. S. Khan, Z. Tan, S. Yun, C. Fleming, and T. Chen (2025) Agents under siege: breaking pragmatic multi-agent llm systems with optimized prompt attacks. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, External Links: Document, Link, 2504.00218 Cited by: Table 2. [71] J. Kim, W. Guo, and D. Song (2026) SoK: attack and defense landscape of agentic AI systems. In 35th USENIX Security Symposium (USENIX Security 26), External Links: Link Cited by: §1, §2.1, §2.2. [72] R. Ko, J. Chung, S. Zheng, C. Xiao, T. Kim, M. Onizuka, and W. Shin (2026) Seven security challenges in cross-domain multi-agent llm systems. npj Artificial Intelligence. External Links: Document, Link, 2505.23847 Cited by: §1, §2.2, Table 1, §6.2.4. [73] D. Kong, S. Lin, Z. Xu, Z. Wang, M. Li, Y. Li, Y. Zhang, H. Peng, X. Chen, Z. Sha, Y. Li, C. Lin, X. Wang, X. Liu, N. Zhang, C. Chen, C. Wu, M. K. Khan, and M. Han (2025) A survey of LLM-driven AI agent communication: protocols, security risks, and defense countermeasures. Note: arXiv preprint arXiv:2506.19676 External Links: Document, Link Cited by: §2.2, Table 1. [74] S. Korn (2026) Architecture matters: comparing RAG systems under knowledge base poisoning. Note: arXiv preprint arXiv:2605.05632 External Links: Document, Link Cited by: §4.3, Table 2. [75] I. Kraidia, I. Qaddara, N. Al-Shafi, M. O. Hiari, R. Alzubaidi, and A. Benlecheb (2026) RAG-induced failures in multi-agent large language model debate. In 2026 1st International Conference on Emerging Technologies and Engineering Systems (ICETES), p. 326–331. External Links: Document, Link Cited by: §2.1, §4.3, Table 2, Table 2. [76] I. Kraidia, I. Qaddara, A. Almutairi, N. Alzaben, and S. B. Belhouari (2026) When collaboration fails: persuasion-driven adversarial influence in multi-agent llm debate. Scientific Reports 16, p. 11640. External Links: Document, Link Cited by: §4.2, §4.2, §4.3, §4.3, Table 2, Table 2. [77] D. Kulshreshtha, W. Du, R. Jain, S. Doss, H. Su, S. Swamy, and Y. Qi (2026) The subtle art of defection: understanding uncooperative behaviors in llm based multi-agent systems. In EACL 2026 Industry Track, p. 571–585. External Links: Link, Document, 2511.15862 Cited by: Table 4, §4.3. [78] A. Le Mercier, C. Develder, and T. Demeester (2026) GAMBIT: a three-mode benchmark for adversarial robustness in multi-agent LLM collectives. Note: arXiv preprint arXiv:2605.09027 External Links: Document, Link Cited by: Table 4, Table 2. [79] D. Lee, M. Tiwari, and B. Miranda (2026) Prompt infection: LLM-to-LLM prompt injection within multi-agent systems. In ESORICS 2025 International Workshops, Lecture Notes in Computer Science, p. 511–520. External Links: Document, Link, 2410.07283 Cited by: §1, §2.1, §3.2, §3.2, §4.2, §4.3, §4.3, §4.3, Table 2, Table 2. [80] H. Lee, V. Yun, H. Oh, D. Panagou, and S. P. Karimireddy (2026) Robust multi-agent LLMs under byzantine faults. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing (EMNLP), External Links: Link Cited by: §5.2, Table 3. [81] C. Li, L. Zhang, J. Zhai, S. Feng, X. Yang, H. Wang, S. Dou, Y. Ji, Y. Hu, Y. Wu, Y. Liu, and D. Zou (2026) Towards security-auditable LLM agents: a unified graph representation. Note: arXiv preprint arXiv:2605.06812 External Links: Document, Link Cited by: Table 4, §6.2.2. [82] F. Li, J. Wu, T. Fu, N. Jaques, W. Zhou, and M. Kan (2026) FlowSteer: prompt-only workflow steering exposes planning-time vulnerabilities in multi-agent LLM systems. Note: arXiv preprint arXiv:2605.11514 External Links: Document, Link Cited by: §4.2, §4.3, §4.3, §4.3, Table 2, Table 2, Table 2, Table 2. [83] K. Li, K. Domico, J. Gregory, and P. McDaniel (2026) MESA: prioritizing vulnerable communication channels for securing multi-agent systems. Note: arXiv preprint arXiv:2606.30602 External Links: Document, Link Cited by: Table 4, §4.3, Table 2, §5.2, Table 3, §6.2.1. [84] K. Li and F. Wu (2026) RoMa: a credibility-aware fault-tolerance framework for LLM multi-agent systems. In International Conference on Computer Supported Cooperative Work in Design, p. 1526–1531. External Links: Document, Link Cited by: §5.2, Table 3. [85] P. Li, X. Zou, Z. Wu, R. Li, S. Xing, H. Zheng, Z. Hu, Y. Wang, H. Li, Q. Yuan, Y. Zhang, and Z. Tu (2025) SAFEFLOW: a principled protocol for trustworthy and transactional autonomous agent systems. Note: arXiv preprint arXiv:2506.07564 External Links: Document, Link Cited by: §5.2, Table 3. [86] T. Li, C. Chu, Y. Zheng, B. Zhang, N. Z. Gong, and C. Xiao (2026) A2ASecBench: a protocol-aware security benchmark for agent-to-agent multi-agent systems. In The Fourteenth International Conference on Learning Representations (ICLR), External Links: Link Cited by: Table 4, §2.1, §3.1, §3.1, §3.2, §4.1, §4.3, §4.3, §4.4, Table 2, Table 2, §6.2.3. [87] W. Li, L. Sun, Z. Guan, X. Zhou, and M. Sap (2025) 1-2-3 check: enhancing contextual privacy in LLM via multi-agent reasoning. In LLMSEC, External Links: Link Cited by: §5.2, Table 3. [88] X. Li, B. Cui, J. Huang, and L. Chen (2026) Robust LLM-based multi-agent system with action negotiation and sharing redundancy enhancement. In Knowledge Discovery and Data Mining, p. 736–747. External Links: Document, Link Cited by: §5.2. [89] Y. Li, Q. Hu, Y. Zhang, L. Quan, J. Yu, and J. Wang (2026) DynaTrust: defending multi-agent systems against sleeper agents via dynamic trust graphs. Note: arXiv External Links: Document, Link, 2603.15661 Cited by: §3.1, §4.1, §5.2, Table 3. [90] Z. Li, Y. Mi, Z. Zhou, H. Jiang, G. Zhang, K. Wang, and J. Fang (2026) Goal-aware identification and rectification of misinformation in multi-agent systems. In The Fourteenth International Conference on Learning Representations (ICLR), External Links: Link Cited by: §5.2, Table 3. [91] R. Liang, L. Yin, J. Chen, Y. Feng, C. Wu, X. Zhang, H. Gu, Z. Zhang, and Y. Liu (2025) Don’t trust your upstream: exploiting LLM multi-agent system via topology-guided adversarial propagation. Note: arXiv preprint arXiv:2512.04129 External Links: Document, Link Cited by: Table 2, Table 2. [92] C. Liu, Y. Guo, Y. Liu, Y. Yang, Q. Yan, X. Zhao, W. Hua, S. Liu, S. Li, Y. Bu, and X. E. Wang (2026) Auditing agent harness safety. Note: arXiv preprint arXiv:2605.14271 External Links: Document, Link Cited by: Table 4, §4.3, Table 2, Table 2, §6.2.1. [93] F. Liu, R. Zhao, S. Chen, G. Li, P. Torr, L. Han, and J. Gu (2025) Can an individual manipulate the collective decisions of multi-agents?. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing (EMNLP), p. 12158–12182. External Links: Document, Link Cited by: §1, §2.1, §3.1, §4.1, §4.2, §4.3, Table 2. [94] J. Liu, S. Du, W. Du, M. Guo, and V. Conitzer (2026) The consensus trap: rescuing multi-agent LLMs from adversarial majorities via token-level collaboration. Note: arXiv preprint arXiv:2604.17139 External Links: Document, Link Cited by: §4.3, Table 2, §5.2, Table 3. [95] J. Liu, D. Cao, Y. Wei, T. Su, Y. Liang, Y. Dong, Y. Liu, Y. Zhao, and X. Hu (2026) Topology matters: measuring memory leakage in multi-agent LLMs. In Findings of the Association for Computational Linguistics: ACL 2026, p. 39728–39746. External Links: Document, Link Cited by: Table 4, §1, §2.1, §2.1, §3.1, §3.1, §3.2, §4.2, §4.3, §4.3, §4.4, Table 2, Table 2, §5.3, §6.1, §6.2.2. [96] Q. Liu, T. Holz, S. Ye, and R. Song (2026) The capability paradox: how smarter auditors make multi-agent systems less secure. Note: arXiv preprint arXiv:2605.17480 External Links: Document, Link Cited by: Table 4, §4.3, Table 2. [97] Y. Liu, S. Shao, S. Guo, C. Wang, C. Yang, and Z. Zang (2026) Topology linearization for multi-agent systems security: mitigating malicious propagation via path decomposition. IEEE Transactions on Network Science and Engineering 13, p. 8481–8498. External Links: Document, Link Cited by: §5.2, Table 3. [98] Z. Liu, G. Li, B. Shi, X. Zhang, J. Ge, Y. Wu, and H. Lyu (2024) CRDA: content risk drift assessment of large language models through adversarial multi-agent interaction. In 2024 International Joint Conference on Neural Networks (IJCNN), p. 1–8. External Links: Document, Link Cited by: Table 4, §4.2, §4.3, Table 2. [99] Y. Luo, Z. Zheng, Z. Zhao, T. Xu, J. Zhao, W. Xue, Y. Chen, and E. Chen (2026) Defending LLM-based multi-agent systems against cooperative attacks with sentence-level rectification. Note: arXiv preprint arXiv:2605.28104 External Links: Document, Link Cited by: §5.2. [100] M. Lupinacci, F. A. Pironti, F. Blefari, F. Romeo, L. Arena, and A. Furfaro (2026) The dark side of LLMs: agent-based attack vectors for system-level compromise. ARES Workshop (AI4TCI). External Links: Document, Link, 2507.06850 Cited by: Table 2. [101] J. Mao, F. Meng, Y. Duan, M. Yu, X. Jia, J. Fang, Y. Liang, K. Wang, and Q. Wen (2025) AgentSafe: safeguarding large language model-based multi-agent systems via hierarchical data management. Note: arXiv preprint arXiv:2503.04392 External Links: Document, Link Cited by: Table 3. [102] Y. Mao, Y. Kang, P. Li, N. Zhang, W. Xu, and C. Zhang (2025) IBGP: imperfect byzantine generals problem for zero-shot robustness in communicative multi-agent systems. In Proceedings of the 24th International Conference on Autonomous Agents and Multiagent Systems (AAMAS), p. 2654–2656. External Links: Document, Link Cited by: §5.2, Table 3. [103] Y. Margalit, N. Cohen-Inger, E. Avram, R. Taig, and O. Margalit (2026) Governed shared memory for multi-agent LLM systems. Note: arXiv preprint arXiv:2606.24535 External Links: Document, Link Cited by: §5.2, Table 3. [104] P. Mateo-Torrejón and A. Sánchez-Macián (2026) GAMMAF: a common framework for graph-based anomaly monitoring benchmarking in LLM multi-agent systems. Note: arXiv preprint arXiv:2604.24477 External Links: Document, Link Cited by: Table 4, §4.3. [105] Y. Mathew, O. Matthews, R. McCarthy, J. Velja, C. Schroeder de Witt, D. Cope, and N. Schoots (2025) Hidden in plain text: emergence and mitigation of steganographic collusion in LLMs. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (IJCNLP-AACL), p. 585–624. External Links: Document, Link Cited by: Table 4, §2.1, §3.1, §4.1, §4.2, §4.3, Table 2. [106] T. McAllister, S. Abdidizaji, I. Garibay, and O. Ozmen Garibay (2026) Smarter saboteurs, better fixers: scaling & security in linear multi-agent workflows. In Agents in the Wild (AIWILD) Workshop at ICML, External Links: Link Cited by: §4.3, Table 2. [107] T. Men, P. Cao, Z. Jin, Y. Chen, K. Liu, and J. Zhao (2025) A troublemaker with contagious jailbreak makes chaos in honest towns. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 17561–17587. External Links: Document, Link Cited by: §4.3, Table 2. [108] Y. Meng, S. S. Narvekar, L. Tang, R. R. Vaje, Y. Zhang, M. Ye, and Z. Xi (2026) EquiMem: calibrating shared memory in multi-agent debate via game-theoretic equilibrium. Note: arXiv preprint arXiv:2605.09278 External Links: Document, Link Cited by: §5.2, Table 3. [109] R. Miao, Y. Liu, Y. Wang, X. Shen, Y. Tan, Y. Dai, S. Pan, and X. Wang (2026) BlindGuard: safeguarding LLM-based multi-agent systems under unknown attacks. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 39215–39234. External Links: Document, Link Cited by: §5.2, Table 3. [110] M. Milkowski and T. Weninger (2026) Deception and communication in autonomous multi-agent systems: an experimental study with among us. In Proceedings of the 25th International Conference on Autonomous Agents and Multiagent Systems (AAMAS), External Links: Document, Link Cited by: Table 4, §4.3. [111] S. R. Motwani, M. Baranchuk, M. Strohmeier, V. Bolina, P. H. S. Torr, L. Hammond, and C. Schroeder de Witt (2024) Secret collusion among ai agents: multi-agent deception via steganography. In NeurIPS, Vol. 37. External Links: Document, Link, 2402.07510 Cited by: §2.1, §2.1, §3.1, §3.2, §4.1, §4.2, §4.3, §4.3, §4.4, Table 2, Table 2. [112] A. Naik, J. Culligan, Y. Gal, P. Torr, R. Aljundi, A. Paren, and A. Bibi (2026) OMNI-LEAK: orchestrator multi-agent network induced data leakage. Note: arXiv preprint arXiv:2602.13477 External Links: Document, Link Cited by: §4.3, Table 2, Table 2. [113] M. Nakamura, A. Kumar, S. Das, S. Abdelnabi, S. Mahmud, F. Fioretto, S. Zilberstein, and E. Bagdasarian (2026) Colosseum: auditing collusion in cooperative multi-agent systems. Note: arXiv preprint arXiv:2602.15198 External Links: Document, Link Cited by: Table 4, Table 2. [114] M. Nakamura, A. Kumar, S. Mahmud, S. Abdelnabi, S. Zilberstein, and E. Bagdasarian (2025) Terrarium: revisiting the blackboard for multi-agent safety, privacy, and security studies. Note: arXiv preprint arXiv:2510.14312 External Links: Document, Link Cited by: Table 4. [115] T. Nguyen, M. Ndebugre, and D. Arremsetty (2026) Security considerations for multi-agent systems. Note: arXiv preprint arXiv:2603.09002 External Links: Document, Link Cited by: §2.2, Table 1. [116] J. Nöther, A. Singla, and G. Radanovic (2026) Benchmarking the robustness of agentic systems to adversarially-induced harmful behaviors. In Proceedings of the 3rd Conference on Language Modeling (COLM), Cited by: Table 4. [117] M. L. Olson, N. Ratzlaff, M. Hinck, T. Nguyen, V. Lal, J. Campbell, S. Stepputtis, and S. Tseng (2026) LieCraft: a multi-agent framework for evaluating deceptive capabilities in language models. In Proceedings of the Fortieth AAAI Conference on Artificial Intelligence (AAAI), Vol. 40, p. 37802–37809. External Links: Document, Link Cited by: Table 4, Table 2. [118] A. Pai (2026) Blind spots in the guard: how domain-camouflaged injection attacks evade detection in multi-agent LLM systems. Note: arXiv preprint arXiv:2605.22001 External Links: Document, Link Cited by: §4.3. [119] J. Pan, Y. Liu, R. Miao, K. Ding, Y. Zheng, Q. V. H. Nguyen, A. W. Liew, and S. Pan (2026) Explainable and fine-grained safeguarding of LLM multi-agent systems via bi-level graph anomaly detection. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 30491–30506. External Links: Document, Link Cited by: §5.1, §5.2, §5.2, §5.3, Table 3. [120] Z. Pan, Y. Zhang, Z. Liu, Y. Y. Tang, Z. Zhang, H. Luo, Y. Han, J. Zhang, D. Wu, H. Chen, H. Lu, H. Fang, M. Li, C. Xu, P. S. Yu, and H. Liu (2026) AdvEvo-MARL: shaping internalized safety through adversarial co-evolution in multi-agent reinforcement learning. In Proceedings of the 43rd International Conference on Machine Learning (ICML), Cited by: Table 2, §5.2, Table 3. [121] K. Pappu, B. Bhushan, and A. Mittal (2025) SPIFFE-based zero-trust authentication for AI agent ecosystems. In 2025 International Conference on Computer and Applications (ICCA), External Links: Document, Link Cited by: §5.2, Table 3. [122] N. Patel (2026) Dynamic attentional context scoping: agent-triggered focus sessions for isolated per-agent steering in multi-agent LLM orchestration. Note: arXiv preprint arXiv:2604.07911 External Links: Document, Link Cited by: §5.2. [123] K. Patil (2026) SentinelAgent: intent-verified delegation chains for securing federal multi-agent AI systems. Note: arXiv preprint arXiv:2604.02767 External Links: Document, Link Cited by: §4.3, §5.2, Table 3. [124] V. Patil, E. Stengel-Eskin, and M. Bansal (2025) The sum leaks more than its parts: compositional privacy risks and mitigations in multi-agent collaboration. Note: arXiv preprint arXiv:2509.14284 External Links: Document, Link Cited by: §2.1, §4.2, §4.3, Table 2, Table 2. [125] P. Peigné, M. Kniejski, F. Sondej, M. David, J. Hoelscher-Obermaier, C. Schroeder de Witt, and E. Kran (2025) Multi-agent security tax: trading off security and collaboration capabilities in multi-agent systems. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39, p. 27573–27581. External Links: Document, Link Cited by: §4.3. [126] S. Prakash (2026) LDP: an identity-aware protocol for multi-agent LLM systems. Note: arXiv preprint arXiv:2603.08852 External Links: Document, Link Cited by: §5.2, Table 3. [127] S. Qi, Y. Zou, P. Li, Z. Lin, X. Cheng, and D. Yu (2025) Amplified vulnerabilities: structured jailbreak attacks on LLM-based multi-agent debate. Note: arXiv preprint arXiv:2504.16489 External Links: Document, Link Cited by: §4.3, §4.3, Table 2, Table 2. [128] Z. Qu, M. Geng, Y. Mao, S. Gu, C. Xu, and H. Wang (2027) Collaborative-adversarial jailbreaking: a propagation-aware attack framework for multi-agent code generation systems. Neural Networks 205, p. 109280. Note: Available online in 2026; assigned to the 2027 journal volume External Links: Document, Link Cited by: Table 4, Table 2, Table 2, §6.2.1. [129] I. A. Rafe, M. R. Dewan, and M. R. Islam (2026) Orchestration and verification of agentic ai systems: a survey of multi-agent collaboration and safety. European Journal of Applied Science, Engineering and Technology 4 (2), p. 238–256. External Links: Document, Link Cited by: §2.2, Table 1. [130] V. Ragupathy (2026) Architectural resilience in ai-driven decision systems under adversarial conditions. In International Conference on Applied Informatics and Communication, p. 1–6. External Links: Document, Link Cited by: §4.3, Table 3. [131] M. H. Rahman, Z. Haider, T. Mahfuz, and P. Chakraborty (2026) HARP: measuring harm amplification in multi-agent LLM systems. Note: arXiv preprint arXiv:2605.27489 External Links: Document, Link Cited by: Table 4, §6.2.2. [132] S. Raza, R. Sapkota, M. Karkee, and C. Emmanouilidis (2026) TRiSM for agentic AI: a review of trust, risk, and security management in LLM-based agentic multi-agent systems. AI Open 7, p. 71–95. External Links: Document, Link Cited by: §1, §2.2, Table 1. [133] A. Reid, S. O’Callaghan, L. Carroll, and T. Caetano (2025) Risk analysis techniques for governed LLM-based multi-agent systems. Technical report Gradient Institute. External Links: Document, Link Cited by: §2.2, Table 1. [134] Q. Ren, Z. Zheng, J. Guo, J. Yan, L. Ma, and J. Shao (2026) When AI agents collude online: financial fraud risks by collaborative LLM agents on social platforms. In International Conference on Learning Representations, Note: arXiv:2511.06448 External Links: Document, Link Cited by: §4.3. [135] J. L. Rippin, S. C. Marshall, D. D. Africa, and C. Schroeder de Witt (2026) Tool use enables undetectable steganography in multi-agent LLM systems. Note: arXiv preprint arXiv:2606.28425 External Links: Document, Link Cited by: §4.3. [136] S. Rodriguez Garzon, A. Vaziry, E. M. Kuzu, D. E. Gehrmann, B. Varkan, A. Gaballa, and A. Küpper (2026) AI agents with decentralized identifiers and verifiable credentials. In ICAART 2026, p. 252–259. External Links: Document, Link, 2511.02841 Cited by: §5.2, Table 3. [137] A. Rose, C. Cullen, S. Abdelnabi, P. Torr, B. G. Kaplowitz, and C. Schroeder de Witt (2026) Detecting multi-agent collusion through multi-agent interpretability. Note: arXiv preprint arXiv:2604.01151 External Links: Document, Link Cited by: Table 4, Table 2. [138] R. Saigal (2026) LLM drift experiment: a framework for quantifying behavioral decay in adversarial multi-agent simulations. Note: Zenodo softwareSoftware artifact External Links: Document, Link Cited by: Table 4, §4.2, §4.3. [139] C. Schroeder de Witt, K. Krawiecka, I. Krawczuk, B. Hagag, W. L. Anderson, P. Belcak, B. Bucknall, X. Cai, A. Chopra, D. Cohen, R. F. Del Rosario, A. Draguns, A. Gray, K. Katz, V. Mavroudis, J. Mink, S. R. Motwani, J. Petit, L. Rembeck, C. Smith, J. Sotiropoulos, S. Young, S. Scheffler, and M. Llewellyn (2025) Open challenges in multi-agent security: towards secure systems of interacting AI agents. Note: arXiv preprint arXiv:2505.02077 External Links: Document, Link Cited by: §1, §2.2, Table 1, §6.2.4. [140] G. Shi, H. Du, Z. Wang, X. Liang, W. Liu, S. Bian, and Z. Guan (2025) SoK: trust-authorization mismatch in LLM agent interactions. Note: arXiv preprint arXiv:2512.06914 External Links: Document, Link Cited by: §2.1, §2.2, Table 1. [141] R. Shi, Y. Wang, M. Du, Q. Zhang, R. Miao, Y. Liu, and X. Wang (2026) SAIGuard: communication-state simulation for proactive defense of LLM multi-agent systems. In Findings of the Association for Computational Linguistics: EMNLP 2026, Cited by: §3.2, §5.2, §5.3, Table 3. [142] M. Singh and N. Mittal (2026) Semantic taint propagation: embedding-based semantic flow monitoring for multi-agent large language model systems. Note: Zenodo External Links: Document, Link Cited by: §5.2, Table 3. [143] X. Sun, Z. Liu, Y. Hu, and Z. Zheng (2026) Insider attacks in multi-agent LLM consensus systems. Note: arXiv preprint arXiv:2605.08268 External Links: Document, Link Cited by: §4.1, §4.3, §4.3, Table 2, Table 2. [144] Y. Sun, H. Yu, W. Jiang, X. Yu, D. Zhan, L. Wang, S. Ren, Y. Sun, and T. Zhu (2026) A survey on the unique security of autonomous and collaborative LLM agents: threats, defenses, and futures. Note: Preprints.org External Links: Document, Link Cited by: §2.2, Table 1. [145] T. A. Syed, M. A. Almutairi, and M. Abdel Moaty (2025) Toward trustworthy agentic AI: a multimodal framework for preventing prompt injection attacks. In 2025 International Conference on Computer and Applications (ICCA), External Links: Link Cited by: Table 2, Table 2, Table 2, §5.2, Table 3. [146] T. A. Syed, M. A. Almutairi, and M. A. Moaty (2025) Cross-agent multimodal provenance-aware framework for robust prompt injection defense in large language and vision-language models. In 2025 International Conference on Computer and Applications (ICCA), External Links: Document, Link Cited by: §5.2, Table 3. [147] Z. Tan, C. Zhao, R. Moraffah, Y. Li, Y. Kong, T. Chen, and H. Liu (2024) The wolf within: covert injection of malice into MLLM societies via an MLLM operative. In CVPR Workshop, External Links: Link Cited by: §4.2, §4.3, §4.3, Table 2, Table 2. [148] R. Tanveer (2026) Multi-agent orchestration: coordination, trust, and cascading failures. Note: SSRN External Links: Document, Link Cited by: §2.2, Table 1. [149] R. Tapwal, A. Kumar, and C. Maple (2026) PRISM: generation-time detection and mitigation of secret leakage in multi-agent LLM pipelines. Note: arXiv preprint arXiv:2605.10614 External Links: Document, Link Cited by: §5.2, Table 3. [150] Y. Tian (2026) Prompt optimization enables stable algorithmic collusion in LLM agents. In ICLR 2026 Workshop on AI for Mechanism Design and Strategic Decision Making, External Links: Link Cited by: Table 2. [151] Y. Tian, X. Yang, J. Zhang, Y. Dong, and H. Su (2023) Evil geniuses: delving into the safety of LLM-based agents. External Links: 2311.11855, Document, Link Cited by: §2.1. [152] H. Triedman, R. D. Jha, and V. Shmatikov (2025) Multi-agent systems execute arbitrary malicious code. In COLM, External Links: Link, 2503.12188 Cited by: §4.2, §4.3, §4.3, Table 2, Table 2. [153] T. Vangalapat and S. I. Shaikh (2026) Trustworthy agentic ai: a survey and taxonomy of secure coordination and hallucination mitigation in multi-agent large language model systems. International Journal of Innovative Science and Research Technology 11 (2), p. 1660–1669. External Links: Document, Link Cited by: §2.2, Table 1. [154] K. Venkatesh, J. Isbarov, S. Amin, M. Kantarcioglu, and J. Cui (2026) CASPIAN: online detection and attribution of cascade attacks in LLM multi-agent systems via cross-channel causal monitoring. Note: arXiv preprint arXiv:2605.19240 External Links: Document, Link Cited by: §5.2, Table 3. [155] T. Walsh, A. van den Hengel, and S. J. Roberts (2026) Self-healing memory architectures for large language model-based multi-agent collaboration. American journal of artificial intelligence and neural networks 7 (1), p. 149–159. External Links: Document, Link Cited by: §5.2, Table 3. [156] H. K. Wang and Z. Zhang (2026) Kill-chain canaries: stage-level tracking of prompt injection across attack surfaces and model safety tiers. Note: arXiv preprint arXiv:2603.28013 External Links: Document, Link Cited by: Table 2, Table 2. [157] J. Wang, S. Yang, T. Qiao, J. Qin, J. Li, Y. Wang, and Y. Zhao (2025) Ev-Trust: an evolutionarily stable trust mechanism for decentralized LLM-based multi-agent service economies. Note: arXiv preprint arXiv:2512.16167 External Links: Document, Link Cited by: §5.2, Table 3. [158] K. Wang, B. Zeng, Z. Wei, C. Jin, H. Zhou, X. Li, C. Yang, J. Qu, X. Xu, and X. Hu (2026) TrinityGuard: a unified framework for safeguarding multi-agent systems. Note: arXiv preprint arXiv:2603.15408 External Links: Document, Link Cited by: Table 4. [159] K. Wang, Z. Zhou, B. Suvonov, J. Lou, and J. Li (2025) MAS-shield: a defense framework for secure and efficient LLM MAS. Note: arXiv preprint arXiv:2511.22924 External Links: Document, Link Cited by: §5.2. [160] L. Wang, W. Wang, S. Wang, Z. Li, Z. Ji, Z. Lyu, D. Wu, and S. Cheung (2026) MASLeak: investigating and exposing intellectual property leakage vulnerabilities in multi-agent systems. In USENIX Security 2026, External Links: Link, 2505.12442 Cited by: §4.2, §4.3, Table 2. [161] M. F. Wang, H. Xie, G. Wang, A. Gao, G. Yang, Z. Li, Q. W. Qiu, F. Han, H. Qiu, Y. Huang, B. Zhu, and J. O. Woo (2026) From debate to decision: conformal social choice for safe multi-agent deliberation. Note: arXiv preprint arXiv:2604.07667 External Links: Document, Link Cited by: §5.2, Table 3. [162] S. Wang, G. Zhang, M. Yu, G. Wan, F. Meng, C. Guo, K. Wang, and Y. Wang (2025) G-safeguard: a topology-guided security lens and treatment on LLM-based multi-agent systems. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 7261–7276. External Links: Document, Link Cited by: §3.1, §3.2, §5.2, Table 3. [163] X. Wang, K. Huang, B. Liang, H. Li, and X. Du (2026) Shadows in the code: exploring the risks and defenses of llm-based multi-agent software development systems. In AAAI, Vol. 40, p. 37970–37978. External Links: Document, Link, 2511.18467 Cited by: §4.2, §4.3, §4.3, Table 2, Table 2. [164] C. Wu, Z. Zhang, M. Xu, Z. Wei, and M. Sun (2026) Securing multi-agent systems against corruptions via node contribution backpropagation. In Proceedings of the 43rd International Conference on Machine Learning (ICML), Cited by: §5.2, Table 3. [165] J. Wu and M. Gong (2026) Beyond single-agent alignment: preventing context-fragmented violations in multi-agent systems. Note: arXiv preprint arXiv:2604.22879 External Links: Document, Link Cited by: §5.2, Table 3. [166] Y. Wu, X. Lin, H. Zhang, N. Sun, K. Wang, C. Zhou, S. Pan, and Y. Cao (2026) CIA: inferring the communication topology from LLM-based multi-agent systems. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 17917–17933. External Links: Document, Link Cited by: §3.1, §4.2, §4.3, §4.3, §4.4, Table 2, Table 2. [167] Y. Xia, T. Wang, W. Xu, and S. Zhang (2025) DAO-Agent: zero knowledge-verified incentives for decentralized multi-agent coordination. Note: arXiv preprint arXiv:2512.20973 External Links: Document, Link Cited by: §5.2, Table 3. [168] T. Xiao, H. Wang, Y. Li, T. Luo, X. Yongfu, D. Kuang, Y. Wang, Y. Liu, and R. Li (2026) You don’t have to be the one doing evil! locate a scapegoat within multi-agent systems for executing covert attacks. In KDD 2026 Workshop on Federated Learning and Multi-Agent Systems (FedKDD/FedMAS), External Links: Link Cited by: §4.3. [169] Y. Xie, C. Zhu, X. Zhang, T. Zhu, D. Ye, M. Qi, H. Chen, and W. Zhou (2026) From spark to fire: modeling and mitigating error cascades in LLM-based multi-agent collaboration. Note: arXiv preprint arXiv:2603.04474 External Links: Document, Link Cited by: §5.2, Table 3. [170] Y. Xie, C. Zhu, X. Zhang, T. Zhu, D. Ye, M. Wang, and C. Liu (2025) Who’s the mole? modeling and detecting intention-hiding malicious agents in LLM-based multi-agent systems. Note: arXiv preprint arXiv:2507.04724 External Links: Document, Link Cited by: Table 4, §4.2, Table 2. [171] Z. Xiong, G. Wu, L. Yao, M. Pan, X. Du, and H. Wang (2026) WebWeaver: breaking topology confidentiality in LLM multi-agent systems with stealthy context-based inference. Note: arXiv preprint arXiv:2603.11132 External Links: Document, Link Cited by: §4.3, Table 2. [172] S. Xu and F. Zhong (2025) CoMet: metaphor-driven covert communication for multi-agent language games. In ACL 2025, p. 7892–7917. External Links: Document, Link, 2505.18218 Cited by: §4.2, §4.3, Table 2, Table 2. [173] Z. Xu, M. Qi, S. Wu, L. Zhang, Q. Wei, H. He, and N. Li (2026) The trust paradox in LLM-based multi-agent systems: when collaboration becomes a security vulnerability. IEEE Transactions on Computational Social Systems, p. 1–12. External Links: Document, Link, 2026.36950 Cited by: Table 4, §2.1, §3.1, §4.1, §4.2, Table 2. [174] F. E. Yagoubi, G. Badu-Marfo, and R. A. Mallah (2026) AgentLeak: a benchmark for internal-channel privacy leakage in multi-agent LLM systems. IEEE Access, p. 94960–94978. External Links: Document, Link, 2026.37045 Cited by: Table 4, §4.2, §4.3, §4.4, Table 2, §6.2.1, §6.2.2. [175] B. Yan, X. Zhang, J. Hou, C. Li, Z. Zhou, X. Zhang, and L. Zhang (2026) PropGuard: safeguarding LLM-MAS via propagation-aware exploration and remediation. Note: arXiv preprint arXiv:2605.16346 External Links: Document, Link Cited by: §5.2, Table 3. [176] B. Yan, X. Zhang, Z. Zhou, C. Li, R. Zeng, Y. Qi, T. Wang, and L. Zhang (2026) Attack the messages, not the agents: a multi-round adaptive stealthy tampering framework for llm-mas. In AAAI, Vol. 40, p. 29784–29792. External Links: Document, Link, 2508.03125 Cited by: §3.2, §4.1, §4.3, §4.4, Table 2. [177] Y. Yang, Y. Jiang, Q. Wang, Y. Tan, X. Zhu, S. S. M. Chow, B. Zheng, and X. Yue (2025) QuadSentinel: sequent safety for machine-checkable control in multi-agent systems. Note: arXiv preprint arXiv:2512.16279 External Links: Document, Link Cited by: §5.2. [178] Z. Yang, W. Ding, S. Feng, and Y. Tsvetkov (2026) Among us: measuring and mitigating malicious contributions in model collaboration systems. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 15969–15988. External Links: Document, Link Cited by: §2.1, §2.1, §3.2, §4.2, §4.3, Table 2. [179] I. Yankeloviz (2026) Algorithmic cowardice: cognitive dissonance and moral conformity in multi-agent LLM interactions. Note: Zenodo External Links: Document, Link Cited by: Table 4. [180] M. S. Yaswanth, S. Chilakala, C. M. K. Reddy, K. Nageswararao, G. J. Manikanta, and P. Vijetha (2026) CAPRI-DP: a differentially private extension to context-aware multi-agent privacy frameworks. In 2026 5th International Conference on Communication, Computing and Electronics Systems (ICCCES), p. 1780–1784. External Links: Document, Link Cited by: §5.2, Table 3. [181] M. Yu, F. Meng, X. Zhou, S. Wang, J. Mao, L. Pang, T. Chen, K. Wang, X. Li, Y. Zhang, B. An, and Q. Wen (2025) A survey on trustworthy llm agents: threats and countermeasures. In KDD, External Links: Document, Link Cited by: §1, §2.2. [182] M. Yu, S. Wang, G. Zhang, J. Mao, C. Yin, Q. Liu, K. Wang, Q. Wen, and Y. Wang (2025) NetSafe: exploring the topological safety of multi-agent system. In Findings of ACL, External Links: Document, Link, 2410.15686 Cited by: Table 4, §2.1, §3.1, §4.2, §4.3, §4.3, §4.4, Table 2, Table 2, §6.1. [183] W. Yu, K. Hu, T. Pang, C. Du, M. Lin, and M. Fredrikson (2025) LLM-based multi-agents system attack via continuous optimization with discrete efficient search. In Proceedings of the Second Conference on Language Modeling (COLM), External Links: Link Cited by: §4.3. [184] M. Zha and X. Wang (2026) Autonomous LLM agent worms: cross-platform propagation, automated discovery and temporal re-entry defense. Note: arXiv preprint arXiv:2605.02812 External Links: Document, Link Cited by: §4.3. [185] L. Zhang, G. Zheng, and H. Chen (2026) When embedding-based defenses fail: rethinking safety in LLM-based multi-agent systems. In ICML, Proceedings of Machine Learning Research, Vol. 306. External Links: Link, 2605.01133 Cited by: §4.3. [186] R. Zhang, X. Zhao, R. Wang, S. Chen, G. Zhang, A. Zhang, K. Wang, and Q. Wen (2026) SafeSieve: from heuristics to experience in progressive pruning for llm-based multi-agent communication. In AAAI 2026, Vol. 40, p. 29892–29900. External Links: Document, Link, 2508.11733 Cited by: §5.2, Table 3. [187] Y. Zhang, Z. Wei, X. Luan, C. Wu, Z. Zhang, J. Wu, H. Wu, H. Chen, J. Sun, and M. Sun (2026) AgentWorm: self-propagating attacks across LLM agent ecosystems. Note: arXiv preprint arXiv:2603.15727 External Links: Document, Link Cited by: §3.1, §3.2, §4.3, §4.3, §4.4, Table 2, Table 2, §5.3. [188] Y. Zhang, Y. Li, T. Zhao, K. Zhu, H. Wang, and N. Vasconcelos (2025) Achilles heel of distributed multi-agent systems. Note: arXiv preprint arXiv:2504.07461 External Links: Document, Link Cited by: Table 4, §4.3. [189] Y. Zhao, Z. Zhang, Q. Le, L. Qu, and Z. Xu (2026) Beyond goodhart’s law: a dynamic benchmark for evaluating compliance in multi-agent systems. Note: arXiv preprint arXiv:2606.07805 External Links: Document, Link Cited by: Table 4, §6.2.1. [190] C. Zheng, Y. Cao, X. Dong, and T. He (2025) Demonstrations of integrity attacks in multi-agent systems. Note: arXiv preprint arXiv:2506.04572 External Links: Document, Link Cited by: Table 2. [191] L. Zheng, J. Chen, Q. Yin, J. Zhang, X. Zeng, and Y. Tian (2026) Rethinking the reliability of multi-agent system: a perspective from byzantine fault tolerance. In AAAI, Vol. 40, p. 35012–35020. External Links: Document, Link, 2511.10400 Cited by: §4.3, §5.2, Table 3. [192] H. Zhou, T. Wu, Y. Jiang, W. Zhou, J. Hu, and A. Han (2026) Hierarchical attacks for multi-modal multi-agent reasoning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 42331–42340. External Links: Link Cited by: §4.3. [193] J. Zhou, L. Wang, and X. Yang (2025) GUARDIAN: safeguarding LLM multi-agent collaborations with temporal graph modeling. In Advances in Neural Information Processing Systems, Vol. 38, p. 8881–8909. External Links: Document, Link Cited by: §3.1, §5.2, Table 3. [194] Y. Zhou, X. Lu, D. Liu, J. Yan, and J. Shao (2026) INFA-Guard: mitigating malicious propagation via infection-aware safeguarding in LLM-based multi-agent systems. In EMNLP, Cited by: §5.2, Table 3. [195] Z. Zhou, Z. Li, J. Zhang, Y. Zhang, K. Wang, Y. Liu, and Q. Guo (2026) CORBA: contagious recursive blocking attacks on multi-agent systems based on large language models. In Findings of ACL, p. 6899–6908. External Links: Document, Link, 2502.14529 Cited by: §4.2, §4.2, §4.3, §4.3, Table 2, Table 2. [196] Z. Zhou, Z. Liu, J. Liu, Q. Shao, Y. Wang, K. Shao, D. Jin, and F. Xu (2026) ResMAS: resilience optimization in LLM-based multi-agent systems. In AAAI, p. 35176–35184. External Links: Document, Link, 2601.04694 Cited by: §5.2, §5.3, Table 3. [197] P. Zhu, L. Li, Y. Lyu, L. Sun, S. Su, and J. Shao (2025) Collaborative shadows: distributed backdoor attacks in LLM-based multi-agent systems. Note: arXiv preprint arXiv:2510.11246 External Links: Document, Link Cited by: §4.3, Table 2, Table 2, Table 2. [198] C. Zou, Y. Yao, S. She, N. D. Goodman, and R. D. Hawkins (2026) CalBench: evaluating coordination-privacy trade-offs in multi-agent LLMs. Note: arXiv preprint arXiv:2605.09823 External Links: Document, Link Cited by: Table 4, §4.3, Table 2, §6.1, §6.2.1. [199] Z. Zou, Z. Liu, L. Zhao, and Q. Zhan (2025) BlockA2A: towards secure and verifiable agent-to-agent interoperability. Note: arXiv preprint arXiv:2508.01332 External Links: Document, Link Cited by: §5.2, Table 3. Appendix A Evaluation Audit Details Table 4 provides the detailed mapping for the 44 works in our evaluation audit. It records their A, C, I, P, and R assignments together with observation depth, comparison design, membership setting, artifact availability, and reported system information. The taxonomy codes follow Sections 2–4. Work Role Adv. Config. Interface Path Risk Obs. Comp. Member Artifact Report A2ASecBench [86] A+D A1–A4 C1–C8 I1–I6 P1–P8 R1,R3–R7 Trace AC Fixed URL MT Achilles Heel [188] A A3 C1,C3–C7 I2,I4,I5 P2,P4,P5,P7,P8 R1–R7 Episode Rel Fixed – MT ACIARena [9] A+D A2–A4 C1–C3,C5,C6,C8 I1–I3,I5,I6 P1–P3,P5,P6,P8 R1,R3–R5,R7 Episode Rel Fixed URL MT Agent-BOM [81] A A1,A3 C2,C3,C5–C8 I1–I4,I6 P1–P3,P5–P8 R1,R4–R7 Trace None Spawn – M AgentLeak [174] A A1–A4 C1–C8 I1–I4,I6 P1–P3,P5–P8 R1,R5 Trace SP Fixed URL NMT AgentXposed [170] A+D A3 C1,C3,C4,C6,C8 I2,I5,I6 P2,P4,P5,P8 R1–R4,R7 Events AC Fixed URL NMT Algorithmic Cowardice [179] A A3 C1–C4,C6–C8 I2,I6 P4,P5 R1,R4 Events AC Fixed URL NMT Among Us [110] A+D A3 C1,C3,C4,C6,C8 I2,I5,I6 P4,P5 R2,R3 Events AC Fixed URL MT ATAG [42] A A1,A2 C1–C3,C5,C7,C8 I1–I5 P1–P3,P5,P7,P8 R1,R4–R6 Events None Fixed URL MT BAD-ACTS [116] A+D A1–A4 C1–C8 I1–I6 P1–P8 R1–R7 Trace AC Fixed URL MT CalBench [198] S – C1–C8 I2–I6 P3–P8 R2,R3,R5,R7 Trace Rel Fixed Claim NMT Capability Paradox [96] A A2 C1–C4,C7,C8 I1,I2,I4,I6 P1,P2,P5,P7 R1,R4,R6 Trace Rel Fixed – MT Child Inherits [21] A A2,A3 C1,C3,C5–C8 I1,I3,I4,I6 P1–P3,P5–P8 R1,R4–R7 Final Rel Spawn – T Collab. Jailbreaking [128] A A2 C1–C8 I1–I6 P1–P5,P7 R1,R3,R4,R6 Events SP Fixed – MT Collusion Interpretability [137] A A3 C1–C5,C8 I2–I6 P2,P4,P5,P7 R2–R4,R6 Events AC Fixed URL NT Colosseum [113] A+D A3 C1–C5,C7,C8 I2,I4–I6 P2–P5 R1–R3 Trace Rel Fixed URL MT CRDA [98] A A3 C2–C6 I2,I3,I5,I6 P2–P5 R1,R3,R4 Events Rel Fixed – N Defection [77] A A3 C2–C8 I2–I6 P3–P5,P7,P8 R2–R4,R7 Events AC Fixed – N GAMBIT [78] A+D A3 C1–C4,C6,C8 I2,I5,I6 P4,P5 R2,R3 Events SP Fixed URL MT GAMMAF [104] A+D A3 C1–C4,C6–C8 I2,I5,I6 P2–P5,P8 R1–R3,R7 Events AC Fixed URL NMT Harness Audit [92] A A1 C1–C5,C7,C8 I1–I6 P1,P2,P6–P8 R1,R4–R6 Trace SP Fixed URL MT HARP [131] A+D A3,A4 C1–C5,C7,C8 I2–I6 P2,P4,P5,P7 R1,R3,R4,R6 Trace AC Fixed – NMT Hidden in Plain Text [105] A+D A3 C2–C4,C6,C8 I2,I5,I6 P4,P6 R2,R3,R5 Events DC Fixed – – LieCraft [117] A+D A3 C1,C3,C4,C6,C8 I2,I5,I6 P4,P5 R2,R3 Events AC Fixed URL NMT LLM Drift [138] A A3 C1–C8 I2,I3,I5,I6 P2–P5 R2–R4 Trace None Fixed URL MT LLM-Deliberation [2] A A3 C1–C7 I2,I3,I5,I6 P3–P6 R2–R5 Events Rel Fixed Claim MT MAC-Bench [189] A+D A2,A3 C1–C5,C7,C8 I1–I6 P1,P3–P8 R3–R7 Trace SP Fixed Claim MT MAGPIE [66] S – C1–C8 I2,I3,I5,I6 P3–P6 R2–R5 Trace DC Fixed URL NMT MAMA [95] A A3 C1–C3,C5,C6,C8 I2,I3,I6 P2,P3,P5,P6 R1,R5 Events Rel Fixed URL NMT MedSentry [28] A+D A2,A3 C1–C6,C8 I1,I2,I5,I6 P1,P2,P4–P6 R1,R3,R4 Events Rel Fixed Claim NMT MESA [83] A A4 C1–C4,C7,C8 I2,I5,I6 P2,P3,P5 R1,R3 Events Rel Fixed URL T NetSafe [182] A A3 C1–C4,C6,C8 I2,I5,I6 P2–P5 R1,R3 Events Rel Fixed URL NT OpenClaw Security [58] A A1,A4 C1–C5,C7,C8 I1,I2,I4–I6 P1,P2,P7,P8 R1,R4,R6 Trace SP Fixed – NMT PEAR [36] A A2,A4 C2–C5,C7,C8 I1–I4,I6 P1–P3,P5–P8 R4–R7 Trace Rel Fixed Claim NM Privacy Leakage [17] A A3 C1–C6,C8 I1–I4,I6 P1,P2,P4–P7 R1,R2,R5,R6 Events SP Fixed – NMT RiskLab [63] A+D A3 C1–C5,C8 I2–I6 P4,P5 R2–R4 Trace None Fixed URL MT SafeAgents [12] A A1,A2 C1–C4,C7,C8 I1,I2,I4–I6 P1,P2,P5,P7 R4,R6 Trace SP Fixed URL MT Security Case Study [38] A A2–A4 C1–C8 I1–I6 P1–P5,P7,P8 R1,R3,R4,R6,R7 Events DC Fixed Up T SNEAK [14] A A3 C2–C4,C8 I2,I5,I6 P6 R5 Events AC Fixed – – TAMAS [69] A+D A1–A3 C1–C4,C6–C8 I1,I2,I4–I6 P1,P2,P4,P5,P7,P8 R1–R4,R6,R7 Trace Rel Fixed URL NMT Terrarium [114] A A3,A4 C1–C8 I1–I6 P2–P6,P8 R1–R5,R7 Trace AC Fixed URL T TrinityGuard [158] A A1–A3 C1–C8 I1–I6 P1–P8 R1–R7 Trace None Fixed URL T Trust Paradox [173] A+D A3 C1–C4,C6–C8 I2,I4–I6 P3–P7 R5,R6 Final Rel Fixed Claim MT WOLF [6] A A3 C1,C3,C4,C6,C8 I2,I3,I5,I6 P3–P5 R2,R3 Trace AC Fixed URL T Table 4: Properties of the 44 security-evaluation works. Role gives attack or failure evaluation (A), defense evaluation (D), and security-property evaluation without an explicit attacker (S). Obs. is the deepest data consumed by the evaluation: final output, episode outcome, principal or message events, or a full trace. Comp. gives the strongest coded comparison: attack or component control (AC), defense or component control (DC), matched single-principal comparison (SP), relation-focused MAS comparison (Rel), or none. Member reports fixed membership or limited runtime spawning. Artifact distinguishes an exact evaluated-artifact URL (URL), a claimed artifact without a recoverable URL (Claim), an upstream-only URL (Up), and no identified artifact (–). Report marks an exact principal count (N), model information (M), and communication topology (T). Taxonomy codes follow Sections 2–4.