Cross-Agent Trust Exploitation

An attacker exploits implicit or excessive trust between cooperating AI agents so that a compromised, malicious, or manipulated agent can influence another agent to execute instructions, access tools, retrieve protected data, or perform actions beyond the originating agent's authority.

Cross-Agent Trust Exploitation targets the trust relationships between AI agents operating inside multi-agent systems.

Enterprise agent architectures increasingly delegate tasks between specialized agents. One agent may perform research, another access internal data, another interact with SaaS applications, while a privileged orchestration agent coordinates the overall workflow.

This creates a new security boundary: an agent may trust information or instructions because they came from another agent rather than because the request was independently authorized.

If an attacker compromises or manipulates one lower-privileged agent, that agent may attempt to influence a more capable peer. The trusted agent can then become a proxy for accessing tools, information, credentials, or actions unavailable to the compromised agent itself.

OWASP specifically identifies multi-agent interactions as an attack surface in agentic systems, while NIST’s AI Agent Standards Initiative is researching authentication and identity infrastructure for secure human-agent and multi-agent interactions.

The result is effectively a transitive trust attack:

Compromise Agent A → Exploit Trust → Influence Agent B → Inherit Agent B’s Capabilities → Reach Protected Objective

An attacker first gains influence over an AI agent through prompt injection, malicious retrieved content, compromised memory, manipulated tools, poisoned external data, credential compromise, or another agentic attack vector.

The compromised agent communicates with another agent inside the workflow.

Instead of treating the incoming message as untrusted data, the receiving agent assumes that another authorized agent has already validated the request.

The receiving agent may therefore execute a tool, retrieve information, delegate another task, modify a workflow, or perform a privileged action.

The attacker has now crossed an authorization boundary without directly compromising the privileged agent.

In more complex environments, the behavior may propagate:

Agent A → Agent B → Agent C → Tool/API → Enterprise Resource

This is particularly dangerous when downstream agents possess progressively greater capabilities.

Recent research on authorization propagation in multi-agent systems describes this broader problem: authorization must remain valid as agents retrieve information, delegate tasks, and synthesize results across changing trust boundaries.

1. Initial Agent Manipulation
The attacker compromises or influences a lower-trust AI agent.

2. Trusted Communication Established
The compromised agent communicates with another agent through the orchestration framework, agent-to-agent protocol, shared context, messaging layer, or workflow.

3. Trust Assumption
The receiving agent interprets the originating agent as an authorized or trusted source.

4. Instruction Propagation
Malicious instructions, manipulated context, or attacker-controlled objectives cross the agent boundary.

5. Capability Discovery
The attacker indirectly identifies tools, permissions, data sources, or actions available to the receiving agent.

6. Privileged Delegation
The receiving agent performs an action that the originating agent could not perform directly.

7. Trust Chaining
Additional agents may receive instructions or results generated by the compromised workflow.

8. Objective Execution
The attacker reaches protected information, systems, tools, or business actions through the accumulated privileges of trusted agents.

• Multi-agent AI platforms
• Enterprise AI agents
• Agent orchestration frameworks
• Agent-to-agent communication protocols
• MCP-enabled environments
• AI workflow automation
• SaaS-integrated agents
• Cloud-connected agents
• Coding agents
• Customer-support agents
• Financial workflow agents
• IT automation agents
• Security agents
• RAG-enabled agents
• Shared-memory systems
• Agents using delegated OAuth access
• Agents operating through service accounts

Multi-agent architectures can unintentionally create privilege paths that do not exist in the underlying applications themselves.

An organization may correctly configure Agent A with limited permissions and assume that limits the damage Agent A can cause.

But if Agent A can instruct Agent B, and Agent B possesses broader access, the effective permissions of Agent A may become significantly greater than its documented permissions.

The problem becomes even more serious when delegation chains span multiple agents.

A compromised low-risk research agent could potentially influence a workflow agent, which communicates with an operational agent, which ultimately possesses access to an enterprise application or privileged tool.

Traditional IAM reviews may show every individual identity as correctly configured while failing to identify the transitive authorization path created by agent collaboration.

For enterprise security teams, the critical question becomes:

Can a low-privilege or compromised AI agent use trusted relationships with other agents to reach capabilities it was never authorized to possess?

Authorized testing should determine whether trust between agents creates an unintended privilege path.

Testing should evaluate whether:

• One agent can issue instructions to another agent
• Agent-originated instructions receive greater trust than external input
• Agent identity is cryptographically or otherwise verifiable
• Messages can be spoofed as originating from trusted agents
• Receiving agents independently authorize requested actions
• Lower-privileged agents can invoke higher-privileged capabilities indirectly
• Tool permissions propagate across agent boundaries
• Delegated credentials exceed task requirements
• Agent messages can override receiving-agent security constraints
• Compromised context propagates between agents
• Sensitive data can move from privileged agents to lower-trust agents
• Agent chains preserve the initiating user’s identity and authorization
• Delegated tasks remain scoped to the original objective
• Authorization survives multi-hop delegation correctly
• Revoked permissions remain usable through another agent
• One compromised agent can influence an entire workflow

Redbot testing should specifically map:

Human Identity → Agent Identity → Delegated Agent → Tool → Resource → Result

At every transition, testers should verify that authentication, authorization, context integrity, and privilege boundaries survive delegation.

Monitor for:

• Unexpected agent-to-agent communication
• Low-privilege agents requesting privileged actions
• Agents operating outside their defined roles
• Abnormal delegation chains
• Rapid increases in delegation depth
• Tool calls inconsistent with the initiating user’s privileges
• Sensitive information moving between unrelated agents
• Agent identity mismatches
• Unsigned or unverifiable agent messages
• Repeated requests after authorization failures
• New agent relationships appearing dynamically
• Privileged actions originating from low-trust workflows
• Agent messages attempting to alter security policies
• Cross-agent propagation of identical instructions
• Unusual shared-memory modifications
• Actions without traceable initiating identities

Cross-Agent Trust Exploitation is primarily an agentic trust and authorization weakness, so there is not a clean one-to-one MITRE ATT&CK technique. Depending on the resulting behavior, associated ATT&CK techniques may include: T1078 — Valid Accounts T1098 — Account Manipulation T1550 — Use Alternate Authentication Material T1213 — Data from Information Repositories T1059 — Command and Scripting Interpreter The final mapping should reflect the action performed through the exploited agent rather than treating cross-agent trust itself as a conventional ATT&CK technique. MITRE ATLAS should also be used when mapping adversarial behavior specifically involving AI systems

OWASP Mapping This record strongly intersects with the OWASP Top 10 for Agentic Applications and the broader Agentic Security Initiative. Relevant areas include: Identity and privilege abuse Tool misuse and exploitation Agent goal manipulation Multi-agent trust boundaries Insecure agent communication Excessive agency / capability exposure OWASP's Multi-Agentic System Threat Modeling Guide specifically extends its agentic threat taxonomy to systems in which multiple autonomous agents coordinate around shared or distributed objectives.