SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems

2609.00595 ↗ · 2026-09-01 · cs.CR, cs.AI

Rui Yang, Junjie Xu, Zhengyu Liu, Neil Fendley, Yang Hong, Ziyang Li, Yinzhi Cao

21 pages

The finding

Headline claim

Failures in multi-agent LLM systems arise through cross-principal interactions that local safety checks miss, and the field lacks the execution-level evidence standards needed to prove an effect is genuinely multi-agent rather than inherited from single-agent vulnerabilities.

The test

A systematization of knowledge, not an experiment: the authors synthesize 197 works (115 peer-reviewed or 10+ citations, 82 emerging) into an A-I-R framework covering six interaction interfaces, four adversary positions, seven risk families, and eight attack paths, and separately audit 44 benchmark and evaluation works.

Effect size & scope

No effect sizes: this is a qualitative taxonomy. Its empirical output is the audit finding that existing evaluations largely lack interaction counterfactuals, end-to-end execution traces, diagnostic metrics like causal provenance, and open-system settings.

Limitations

The authors concede their framework labels are synthesis shorthands, that configuration dimensions (C1-C8) change together so controlled comparison is hard, that threat models must track dynamic membership and authority rather than initial attacker state, and that path closure and recovery remain open defense gaps. The text provided is truncated mid-discussion, so full defense and evaluation sections are incomplete. Corpus selection and coding criteria are author-judgment based, and no inter-rater reliability or artifact release was verifiable in the provided text.

Counterpoint

A skeptic would note this is a survey producing a vocabulary, not evidence: the A-I-R framework's usefulness is untested, the claim that prior surveys lack 'systematic' coverage rests on the authors' own coding rubric, and a 197-paper corpus in a fast-moving area may already be stale. No new experiments validate that the proposed counterfactual standards are practical for practitioners to run.

Economy implication

Little or nothing yet on economics directly, but the audit implies that current multi-agent security evaluations cannot yet support enterprise claims about safe deployment of agent fleets, which is a soft discount on near-term agentic-product liability and procurement confidence rather than a measured cost.

Who this matters for

Technical Capability: Researchers building multi-agent systems get a concrete evidentiary bar: to claim an interaction-level security effect, run a relation-removal counterfactual and trace the attack end to end.

Regulatory & Legal: Anyone drafting agent-safety or AI-liability rules should note that current benchmark evidence cannot yet distinguish multi-agent failures from single-agent ones, complicating certification of agent systems.

Abstract

Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely multi-agent security effect. We thus systematize MAS security through an execution-centered analysis of 197 works, covering six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS. We organize defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identify path closure and recovery as key challenges. We audit 44 evaluation and benchmark works and identify open challenges in isolating interaction effects, designing comparable and diagnostic metrics, supporting reuse across MAS designs, and evaluating open-system operation. Together, these findings motivate an interaction-aware view of MAS security: trace attacks end to end, test whether defenses close those paths, and evaluate system-level effects with appropriate counterfactuals.