Multi-agent LLM systems face 14 new injection attack vectors
A new threat taxonomy exposes vulnerabilities unique to multi-agent LLM systems that single-model defenses cannot address. The research identifies 14 attack vectors spanning direct user injection, tool-output poisoning, inter-agent message manipulation, and orchestrator compromise. This matters because production deployments increasingly chain multiple models together for reasoning and task execution, creating lateral attack surfaces where a compromised agent can propagate influence upstream. The work signals that current prompt injection mitigations are insufficient for the emerging architecture of AI systems.
Modelwire context
ExplainerThe critical insight is that current prompt injection defenses assume a single model boundary. Multi-agent systems create lateral propagation paths where a poisoned tool output or compromised intermediate agent can influence upstream decision-making, requiring defenses that span the entire orchestration layer, not just input validation.
This work directly extends the safety-by-architecture theme from recent papers. The AgentRouter paper from September 19th formalized multi-step agentic workflows as a routing problem, but focused purely on cost optimization. This threat model reveals that the same orchestration complexity that enables efficiency also creates new attack surfaces. Similarly, the detective game paper from the same date used a tri-agent pipeline with verification steps to prevent LLM fabrication, but didn't address adversarial injection across agent boundaries. This research signals that as enterprises move from single-model deployments to orchestrated multi-agent systems (as AgentRouter assumes they will), security architecture must evolve from perimeter-based input filtering to cross-agent validation.
If major cloud providers (AWS Bedrock, Azure AI, Google Vertex) ship native multi-agent orchestration guardrails within the next 6 months that explicitly address inter-agent message validation, that confirms this threat model has moved from academic to operational priority. If they don't, the gap between research and production deployment remains wide.
Coverage we drew on
This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.
MentionsLLM · multi-agent systems · prompt injection · orchestrator
Modelwire Editorial
This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.
Modelwire summarizes, we don’t republish. arXiv cs.CL originally reported this story as “Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.