From monoliths to swarms: role decomposition brings attack surfaces a single agent never had

Yashaswi Malla, Sandra Siby · 2 authors · New York University Abu Dhabi · 2026 · arXiv:2608.00202

Does splitting the work across agents open an attack a single agent cannot have?

Opening

The standard pitch for multi-agent web systems is performance: decompose a complex task across specialized sub-agents and each one gets better at its slice. The paper asks what that decomposition costs on the other side of the ledger. Role specialization introduces structural attack surfaces that are absent in single-agent systems, the authors observe, and this expanded surface remains poorly understood and inadequately categorized. Anyone who has just sold a client a team of agents needs that inventory before the team ships.

What the paper does

The authors propose a taxonomy of attack vectors specific to web-based multi-agent systems, covering vulnerabilities introduced or amplified by having several agents involved, and present a test-bed, WebMASLab, to analyze web agent security against a fully external, web-only adversary. To isolate the effect of architecture, they keep the user task, tool surface, and browser substrate fixed while comparing single- and multi-agent setups. Three adversarial scenarios run across three conditions: baseline, prompt-hardened, and reasoning-enabled. The centerpiece is a novel MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops.

Findings

The role split creates its own surface — The gain in task performance comes bundled with vulnerabilities that exist only because the work is divided among several agents in the first place.

such role decomposition introduces new structural attack surfaces that are absent in SAS

A loop built from delegation itself — The new attack does not target a model’s weaknesses directly. It turns the delegation channel into a cycle, so agents keep handing the same task around instead of finishing it.

a novel MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops

Three of four frontier models fall for it — Against a single agent the attack does nothing at all, but in multi-agent setups it compromises three of the four frontier models evaluated, averaging 80% across them at baseline. Only the fourth resists, with a 92% detection rate.

The attack is inert against SAS but compromises MAS when powered by three of the four frontier models evaluated

Caveat

The authors state their evaluation boundary rather than a weakness: WebMASLab studies web agent security against a fully external, web-only adversary. Everything measured, the Telephone Loop results included, sits inside that test-bed with the task, tool surface, and browser substrate held fixed, so the numbers describe that setting and not web agents in general.

What this means for 5ac

When 5ac builds an agent team for a client, the delegation graph itself is an attack surface. A child card that can hand work back to its parent, or a ring of cards each waiting on the next, is exactly the shape the Telephone Loop exploits. The concrete guard belongs at the protocol layer: detect cycles when cards are linked, cap how deep a spawn chain may run, and give every chain one profile that holds the authority to end it. Prompt-hardening alone does not generalize, the paper shows, with one model’s attack success rate collapsing from 100% to 8% while the others barely move.

Source