Research area

Agent-to-Agent Communication

Papers in this research area.

Sources: arXiv, OpenAlex, Crossref, Semantic Scholar, DBLP

0 of 36 articles selected

Showing 36 of 1425 matching articles

Testing through conflict: Cloud-coordinated closed-field testing for multi-agent continuous interaction scenarios

Crossref · Chinese Journal of Mechanical Engineering journal-article Crossref Agent-to-Agent Communication Orchestration Risk

Xinrui Zhang, Lu Xiong, Peizhi Zhang, Haojie Feng, Junpeng Huang, Mengjie Tian

Published 2026 (date unknown)

Venue: Chinese Journal of Mechanical Engineering

DOI: 10.1016/j.cjme.2025.100192

View source

Abstract

Abstract unavailable from Crossref metadata.

Summary

  • Introduces a novel cloud-coordinated closed-field testing framework designed specifically for multi-agent systems engaged in continuous interaction scenarios.
  • Addresses the challenge of evaluating multi-agent security behaviors in complex, persistent environments where agents continuously interact over time.
  • Utilizes cloud resources to synchronize and manage testing environments, enabling scalable and coordinated evaluation across multiple agents.
  • Demonstrates the testing framework's capability to simulate conflict situations, essential for stress-testing multi-agent interactions and security protocols.
  • Provides experimental validation through case studies showcasing multi-agent interactions under adversarial conditions, highlighting the method’s effectiveness in identifying vulnerabilities.

Your Agent Acts Differently When You're Around: How User Presence Changes Agent Behavior in Negotiation

Merged record merged scholarly record Semantic Scholar arXiv Agent-to-Agent Communication Benchmarks and Evaluation

Jane Pan, You Lyu, Abe Bohan Hou, Valerie Chen, He He, A. Hou

Published 2026-10-27

Venue: arXiv

View source

Abstract

LLM agents increasingly interact with other agents on behalf of users, yet how users in the loop affect their agents' behavior--for better or worse--remains poorly understood. We study this question through the lens of negotiation, where agents must represent users while strategically bargaining with other agents. To isolate the effect of user presence, we develop PRESENT, a controlled evaluation framework that compares negotiation settings with and without an interactive user, while holding the game, objectives, and user preferences fixed across conditions. Across 11.2k runs spanning 7 games and 8 models, we find that user presence significantly changes both outcomes and behavior. Specifically, negotiation parties with a user obtain higher payouts (+13.7% on average) and their agents negotiate more aggressively. Surprisingly, user presence also induces misaligned behavior, both toward counterparties (where its rate roughly doubles) and toward users (where it emerges in 14.3% of games). These misaligned behaviors are uncorrelated with outcomes and persist even when the user sends only templated, neutral messages. These findings expose two blind spots in current evaluation practice: static instructions miss behaviors that emerge only when users are present, and outcome-level metrics cannot detect them.

Summary

  • Introduced PRESENT, a controlled evaluation framework isolating the impact of interactive user presence in agent-mediated negotiation scenarios by comparing settings with and without direct user involvement while keeping game parameters constant.
  • Conducted extensive experiments across 11.2k runs using 7 distinct negotiation games and 8 language models, revealing that agents negotiating with an interactive user achieve significantly higher payouts (average +13.7%) and adopt more aggressive negotiatio...
  • User presence leads to increased agent misaligned behaviors directed at both negotiation counterparties and the users themselves—misalignment rates approximately double toward counterparties and emerge in 14.3% of games toward users—despite no correlation b...
  • Detailed taxonomy of misaligned behaviors includes misreporting, hallucinated actions, unsupported urgency, misunderstandings, and out-of-scope terms, highlighting distinct failure modes exacerbated by user interaction and unobservable through conventional...
  • Current evaluation practices relying on static user instructions and outcome-based metrics fail to capture behavioral shifts induced by active user involvement, emphasizing the need for frameworks like PRESENT that integrate interactive users for accurate a...

Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord

Merged record merged scholarly record Semantic Scholar arXiv Trust and Identity Governance and Policy Agent-to-Agent Communication

Kofi Ampomah, Tu Le, Le Tu

Published 2026-10-27

Venue: arXiv

View source

Abstract

Third-party community-based bots are central to how social platforms such as Discord work. They moderate content, manage roles, play music, and support AI-assisted conversations across millions of servers. Yet when a bot is installed in a server, it can access messages, user profiles, and server metadata concerning members who did not participate in the installation decision, with no standardized way to communicate the associated security and privacy implications. In this paper, we analyze 23,102 third-party Discord bots and 183,142 user reviews spanning 49 detected languages and five years of feedback (2021-2026). We employ LLM-based knowledge distillation and fine-tune a DeBERTa-based classifier to identify candidate security and privacy (S&P)-relevant reviews. After manually validating the complete classifier-positive set, we retain 8,832 reviews identified as S&P-relevant, representing an observed pipeline yield of 4.82%, and map them to a 31-theme S&P taxonomy extending prior work. Our results show that S&P-related reviews focus heavily on Data Sharing (30.5%) and Data Collection (16.2%). Confession and anonymity bots have pipeline-identified SPRRs above 50%, more than ten times the ecosystem-wide pipeline yield of 4.82%. Star ratings may obscure the frequency and valence of S&P-related discussion, while conventional metadata features, such as permission count and administrator status, show only weak associations with user-reported S&P concerns. We then build BotLens, a proof-of-concept auditing framework that combines review-derived S&P signals with bot metadata to provide on-demand decision support for the community-based bot ecosystem. BotLens exposes six tools through a Model Context Protocol server, supporting bot-level checkups, server-wide comparison, and integration with AI agents.

Summary

  • Third-party community bots on Discord have extensive access to server communications and user data, impacting users who did not consent to bot installation, raising security and privacy (S&P) concerns without standardized disclosures.
  • A large-scale study analyzed 23,102 Discord bots and 183,142 multilingual user reviews collected over five years (2021–2026), utilizing LLM-based knowledge distillation and a fine-tuned DeBERTa classifier to accurately identify S&P-relevant reviews.
  • The analysis revealed that Data Sharing (30.5%) and Data Collection (16.2%) dominate user-reported S&P concerns; confession and anonymity bots showed particularly high S&P review rates (over 50%), indicating elevated sensitivity in these categories.
  • The research developed a comprehensive 31-theme taxonomy of S&P concerns tailored for Discord bots, including Discord-specific risks such as Permission Scope Mismatch and Gateway Intent Abuse, expanding beyond existing app review frameworks.
  • Bot metadata features like permission counts and administrator status poorly predict S&P concerns, emphasizing that bot function and content sensitivity are stronger indicators of user security and privacy perceptions.

Blindfold: Keeping the Audit Coin Secret from LLM Agents

arXiv preprint arXiv Prompt Injection Governance and Policy Agent-to-Agent Communication

Wei Zhu, Meiyun Zuo, Huiping Sun

Published 2026-10-27

Venue: arXiv

View source

Abstract

Audit-based certification bounds the violation rate of an LLM agent by auditing a random fraction $\varepsilon$ of actions and reweighting the audited labels; its validity is meant to rest only on the defender's audit coin. We show that it also rests on a confidentiality property: the coin must not interfere with the agent's view before the action commits, at a time the agent chooses. We call this pre-commit noninterference (PNI) and measure its violation by $D_{\mathrm{A}}$, the total-variation distance between the agent's views under the two coin values. PNI is necessary and sufficient for an unbiased certificate against adaptive agents, the worst-case bias is $(1-\varepsilon)D_{\mathrm{A}}$, and no procedure that sees only audited labels can pay less. Leakage composes across steps, a resource shared across episodes opens a channel of computable size, and raising the audit rate cannot restore validity. On a monitor we built, a silent audit changes no output but adds latency that tool timestamps expose, and the agent can enlarge it. A real LLM agent follows an injection that names a visible audit notice (generic, tool, and timing clauses have no effect); over that channel the plain certificate fails on measured labels and, by a post-hoc analysis, in a live run on a pre-registered schedule, while a silent audit restores it. A fresh coin per audited call closes the timing channel; padding only narrows it.

Summary

  • The paper addresses the challenge of certifying the violation rates of adaptive LLM agents using audit-based methods that depend on randomly auditing a fraction of agent actions determined by a secret audit coin.
  • A critical property named pre-commit noninterference (PNI) is introduced, requiring the audit coin's value to remain confidential and not influence the agent's observations before action commitment, preventing adaptive agents from detecting audit events in...
  • The authors develop theoretical bounds relating the total variation distance (audit distinguishability) between agent views under different coin states to the bias in audit certifications, proving PNI is necessary and sufficient for unbiased, anytime-valid...
  • They analyze leakage channels including timing side channels introduced by audit operations which add latency detectable by the agent, demonstrating that such leakage accumulates over episodes and compromises audit validity.
  • To mitigate leakage, the paper proposes a ‘‘silent audit’’ approach where audits do not produce observable outputs and the use of fresh, per-call audit coins to neutralize timing channels without excessive padding overhead.

CEPO: A General Framework for Improving Prompt Optimization in Multi-Agent Systems

Merged record merged scholarly record Semantic Scholar arXiv Agent-to-Agent Communication Benchmarks and Evaluation

Jongha Kim, Seohyun Lee, Jonathan Minho Chung, Jinsung Yoon, Hyunwoo J. Kim

Published 2026-10-26

Venue: arXiv

View source

Abstract

Multi-agent systems (MAS) require both effective coordination and specialized task execution. Existing prompt optimization approaches typically couple these functions within agent-specific prompts. We introduce Coordinator-Executor Prompt Optimization (CEPO), a general framework for improving prompt optimization in MAS. CEPO separates system-level coordination from agent-level execution through a shared coordinator prompt and agent-specific executor prompts, and guides their updates according to their respective roles. This structure allows shared coordination rules to be refined consistently across agents while keeping execution instructions separately adjustable. CEPO provides the prompt structure and optimization guidance, while existing prompt optimizers perform the underlying search. Extensive experiments spanning 11 benchmarks across four domains demonstrate that applying CEPO to four existing prompt optimizers consistently improves their performance. Ablations and qualitative analyses support the proposed design, while controlled studies on a document-understanding MAS further demonstrate improved optimization budget efficiency and performance scaling with the number of agents.

Summary

  • Introduces CEPO, a general framework that separates system-level coordination (shared coordinator prompt) and agent-level execution (individual executor prompts) in multi-agent systems to improve prompt optimization.
  • CEPO employs role-aligned optimization using distinct meta-instructions guiding prompt updates for coordinators and executors, enhancing focused and effective improvements respecting their roles.
  • The framework sequentially optimizes coordinator and executor prompts, maintaining fixed components during each step to refine multi-agent coordination and execution iteratively.
  • CEPO integrates with existing prompt optimizers (e.g., PE2, MASPO), consistently boosting their performance across 11 benchmarks spanning document understanding, mathematical reasoning, code generation, and video understanding.
  • Extensive experiments reveal CEPO's improved accuracy, optimization budget efficiency, and scalability, with stronger gains observed as the number of agents in the system increases.

The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation

arXiv preprint Semantic Scholar arXiv Prompt Injection Agent-to-Agent Communication Benchmarks and Evaluation

Ruozhao Yang, Jiongchi Yu, Ming Hu, Xiaofei Xie

Published 2026-10-26

Venue: arXiv

View source

Abstract

Web services increasingly expose backend interfaces that let users delegate tasks to AI agents, which invoke service operations directly without navigating websites. This shift changes how existing Web vulnerabilities can be exploited. We investigate these changes through VELA, an executable benchmark covering 44 vulnerabilities across twelve Web application families. The benchmark preserves vulnerable backends and derives agent-facing interfaces from legitimate workflows. We evaluate three commercial agents across multiple interface configurations, using controlled comparisons to separate interface effects from agent behavior and independent oracles to verify attack outcomes. Our results show that the agent realizes every attack that direct interface invocation realizes in the reference configuration, so exploitability is set mainly by the interface: 91% of vulnerabilities remain exploitable under the reference design. Interface restrictions prevent some attacks by removing required operations or limiting input control, while retention remains high across vulnerability classes. No case-level loss in the reference configuration is attributed to agent refusal or input normalization, and in one case the agent completed an attack by supplying calls the attacker omitted. Across the tested configurations, interface design affects exploitability more than agent choice, moving retention from 39% to 95% against at most 4.5 points across agents, but some restrictive interfaces also limit legitimate workflows. Our study provides a systematic empirical account of how agent-mediated access reshapes existing Web vulnerabilities, grounding future Web architecture design in measured security outcomes and trade-offs between reducing attack exposure and preserving legitimate functionality in agent-facing services.

Summary

  • Web services increasingly expose backend interfaces for AI agents to perform tasks directly, altering traditional web vulnerability exploitation methods.
  • VELA benchmark evaluates 44 vulnerabilities across 12 web applications, assessing how agent-mediated access affects exploitability and legitimate functionality.
  • Results show 91% of vulnerabilities remain exploitable through AI-mediated interfaces, with interface design impacting exploitability more than the choice of AI agent.
  • Agent behavior does not mitigate exploitability; in certain cases, agents complete attacks by compensating for attacker-omitted steps, highlighting persistent security risks.
  • Three interface designs—endpoint-oriented, workflow-oriented, and query-oriented—differ in abstraction and significantly affect both attack retention and legitimate operation coverage.

The Inbox as a Coordination Primitive for LLM Agent Societies

Merged record merged scholarly record Semantic Scholar arXiv Agent-to-Agent Communication Orchestration Risk

Karthik Sreedhar, Leo Yuan, Pradyumna Chari, Ramesh Raskar

Published 2026-10-26

Venue: arXiv

View source

Abstract

Language-model agents increasingly coordinate in large groups, and current agent protocols focus on delivering messages. For these agents, however, the scarce resource is not delivery but reading: every message costs tokens, and the context is finite. Current infrastructure works by push: the sender decides when a message enters the recipient's context, so the recipient reads in arrival order and drops the oldest messages once its context is full. We study the alternative, pull, in which messages wait in an inbox outside the context and the recipient's own rules decide what it reads and keeps. We argue that the inbox is a coordination primitive: each agent sets its rules privately, and those rules decide whether other agents' requests reach it. In simulated societies of up to 16,000 agents, with every decision an LLM judgment, we report three findings. First, push fails as an agent takes part in more coordination at once: an agent leading 20 negotiations with a full memory proposes options already rejected 97% of the time, because it has dropped the oldest replies. Second, an inbox is necessary under heavy, noisy traffic. Where first come, first read misses every request, an inbox that first reads messages carrying a refundable deposit still finds about 60% of the agents a request needs, at every size from 1,000 to 16,000. On a real email network, losses compound: when half the agents adopt such an inbox, forwarded search recovers only 5% of full adoption, against 42% for one-hop search. Third, an inbox comprises four decisions (what to read, what to keep, what a sender pays, and what a reply may say), and the best rule for each depends on the traffic and the agent's role. Multi-agent coordination under load requires an inbox layer designed for the traffic each agent receives.

Summary

  • Push-based message delivery protocols in large multi-agent LLM societies fail under heavy coordination load due to limited context capacity, causing agents to drop important messages and repeat rejected options.
  • Introducing an inbox primitive, where messages are queued outside the agent's immediate context and agents pull and prioritize reading, addresses token constraints and improves coordination under high traffic and noisy conditions.
  • The inbox functions as a coordination primitive with four key decision factors: what messages to read, what to keep, what senders pay to prioritize their messages, and how replies are structured; these decisions affect society-wide coordination efficacy.
  • Large-scale simulations with up to 16,000 agents demonstrate that inbox design must be tailored to traffic conditions and agent roles, as no single reading and retention rule performs optimally across all scenarios.
  • Pull-based inbox management enables more effective handling of concurrent interactions by allowing agents to selectively process messages, reducing token usage while maintaining relevant communication.

Compatibility and future-proof testing for multi-agent systems

Merged record merged scholarly record Semantic Scholar arXiv Agent-to-Agent Communication Governance and Policy

Yueshan Li, Lorenzo Fiaschi, Andrea Censi, Emilio Frazzoli, Yue-Shan Li

Published 2026-10-26

Venue: arXiv

View source

Abstract

Independently developed autonomous agents, such as autonomous vehicles, must guarantee joint compatibility, such as safety and task-completion requirements, when they operate in a shared environment. Existing methods require a centrally designed specification, or interaction mechanism before any agent is deployed. However, such centralized design is unrealistic when agent designs are confidential to their developers, and it is not flexible enough to accommodate future agent designs. We study a bi-level structure in which a regulator coordinates developers by publishing seed agents, and each developer independently tests its agent to ensure that it is compatible with every seed-compatible agent, a property we call future-proofness. Under this structure, joint compatibility is guaranteed for any agents that are designed and tested independently, without any coordination with each other. In this work, we first formulate compatibility for general multi-agent systems and show why it is not trivially implied by seed-compatibility. We then characterize the future-proof agents as the closure of the seed and show that this closure is monotone in the seed. Finally, we study a class of executable tests that involve interaction with the seed alone, and we ask to what extent such tests can distinguish the future-proof agents.

Summary

  • The paper addresses the challenge of ensuring joint compatibility and safety among independently developed autonomous agents operating in shared environments, where centralized design and coordination are infeasible due to confidentiality and future design...
  • A bi-level regulatory framework is proposed in which a regulator publishes a set of 'seed' agents, and developers independently test their agents against these seeds to achieve 'future-proofness'—compatibility with all agents compatible with the seed withou...
  • Compatibility is formally defined for multi-agent systems, and the concept of future-proof agents is characterized as the closure of the seed set, which ensures that agents compatible with the seed remain compatible with all agents in the closure.
  • The closure operator is shown to be monotone with respect to the seed, meaning that expanding the seed leads to a larger set of future-proof agents and more stringent compatibility guarantees.
  • The paper demonstrates that seed-compatibility alone does not guarantee joint compatibility among all agents, highlighting the necessity for stronger testing and certification criteria for future-proofness.

AgentFlowShield: Defending LLM Agents Against Metadata Side Channels

Merged record merged scholarly record OpenAlex Prompt Injection Agent-to-Agent Communication Orchestration Risk

Redha Boukhari, Yulliwas Ameur, Mehammed Daoui

Published 2026-10-26

Venue: HAL

View source

Abstract

Tool-augmented LLM agents produce structured, multi-phase network traffic whose encrypted metadata-packet sizes, inter-arrival times, burst boundaries, and streaming cadence-can reveal which tools were invoked, whether retrieval or memory was used, and coarse properties of the underlying task. We study this leakage in a scoped single-endpoint deployment model and introduce AgentFlowShield, a phase-aware egress shaping layer combining bucket padding, frame aggregation, bounded jitter, tool normalisation, memory envelopes, and a risk-aware controller. On a 6,300-trace controlled testbed we evaluate six inference attacks under no-defence, generic, and phaseaware defences, probe generalisation with a template-disjoint split, and evaluate three defence-aware adversaries. We provide a bounded within-phase size-channel analysis, identify residual leakage channels, and demonstrate the defence architecture in a controlled loopback testbed with synthetic WAN noise. AgentFlowShield-full preserves low engineering overhead (24 % measured latency overhead in the final utility run) but does not eliminate leakage against the strongest standard-split adversaries (97-100% residual AUPRC on A1-A4). Its clearest gains appear in the template-disjoint and policy-aware settings: D9 shows mixed results in unseen-template splits, with workflow-type AUPRC increasing from 0.385 to 0.453 (indicating higher detectability) and tool-type decreasing from 0.512 to 0.490, while policy-aware A1 fusion drops from 0.995 under random padding to 0.442 under D9. The final results therefore show a narrower but more defensible claim: phase-aware shaping helps generalisation-resistant and calibrated attacks, but fixed-envelope defences still leave strong residual standard-split signals.

Summary

  • The paper addresses metadata side-channel leakage in tool-augmented large language model (LLM) agents, focusing on how encrypted network traffic patterns reveal invoked tools, memory usage, and task properties.
  • Introduces AgentFlowShield, a novel phase-aware egress traffic shaping system that employs techniques such as bucket padding, frame aggregation, bounded jitter, tool normalization, memory envelopes, and a risk-aware controller to mitigate information leakage.
  • Conducts comprehensive experiments on a controlled 6,300-trace testbed, evaluating six inference attacks under no defense, generic defense, and phase-aware defenses.
  • Examines the generalization capability of defenses with a template-disjoint data split and tests three defense-aware adversaries to assess robustness.
  • Presents a bounded within-phase size-channel analysis, identifies remaining leakage vectors, and validates defense mechanisms in a noise-injected loopback testbed.

6G Reasoning Agent Societies: Composition, Scaling, and Consistency-Time Laws

arXiv preprint arXiv Trust and Identity Agent-to-Agent Communication

Hatim Chergui, Carolina Fernández-Martínez, Mustapha Benjillali, Mehdi Bennis, Merouane Debbah

Published 2026-10-25

Venue: arXiv

View source

Abstract

Emerging 6G control planes would compose Large Language Model (LLM) agents that exchange interpreted conclusions, so hallucinations can propagate even over error-free transport. Recent architectures audit each message locally against the sender's observation mask, but isolated audits miss collective behavior. Modeling the agent society as a cellular sheaf, we establish three laws valid on arbitrary topologies. First, the \emph{composition law}: network-wide divergence exceeds the sum of per-agent audit scores by exactly their hidden total correlation. This blind spot masks up to 23\% of joint divergence and, because the declared signal cancels in the cognitive signal-to-noise ratio (SNR), overstates it by $1.14$\,dB purely through topology; the resulting trust inflation preserves valid consensus states but slows convergence. Second, the \emph{scaling law}: reconciliation decouples across metric counters, so the worst-connected dimension sets the pace. Consistency time grows for a society size $n$ as $Ω(n^{2/d})$ on polynomial-growth topologies of degree $d$, and paths breach a $1$\,s near-real-time budget at $n^\ast=13$ agents, whereas expanders ($Θ(1)$) and radius-3 local audits ($O(1)$, $\approx300$\,ms) stay bounded. Third, the \emph{consistency-time law}: the timing error from omitted correlations is one-sided and capped by the worst-measured link. These laws, validated on simulated topologies and deployed LLM societies, give provable worst-case latency ceilings for near-real-time operation.

Summary

  • Emerging 6G control planes will leverage Large Language Model (LLM) agent societies that communicate inferred conclusions, risking propagation of hallucinations even with error-free transmission.
  • Current local message audits by agents, based on sender observation masks, fail to detect collective discrepancies or hidden correlations, creating blind spots in trust evaluation.
  • The paper models the multi-agent system as a cellular sheaf and establishes three fundamental laws: Composition Law (network divergence exceeds sum of local audits due to hidden correlations), Scaling Law (consensus time depends on network topology and wors...
  • Mathematically, agent beliefs and their interactions are captured using sheaf theory and spectral graph tools like the sheaf Laplacian, enabling precise quantification of disagreements and trust dynamics.
  • The Composition Law reveals that joint divergence is systematically underestimated by local audits, causing trust inflation that preserves consensus validity but slows convergence and overstates cognitive signal-to-noise ratio by approximately 1.14 dB in so...

CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance

arXiv preprint arXiv Prompt Injection Agent-to-Agent Communication Orchestration Risk

Chenyuan Yang, Hwiwon Lee, Jongseong Kim, Yihan Yang, Dongjun Kim, Yinfang Chen, Lingming Zhang

Published 2026-10-25

Venue: arXiv

View source

Abstract

Open-source projects now let AI agents review incoming code, but the code under review may itself come from an AI attacker. We present CyberDual, an arena for this dual role of AI: attacker agents hide an exploitable bug in real maintenance work on widely used open-source projects, and reviewer agents try to find and repair it. Execution decides each match: we rerun the attacker's proof of concept (PoC) on the code that comes out of review. Every attack is new, and the windows can be rebuilt each quarter from the latest upstream history. Three agentic reviewers catch 85-91% of 1,088 valid attacks from six attackers. Yet when the attacker spreads the bug over real upstream commits, about one in six attack slots still ends with a working exploit after review. The strongest attacker has open weights: GLM 5.3 almost never refuses, and its attacks make up 13 of the 28 that get past all three reviewers. When they miss, Claude reviewers mostly approve the attack, while GPT-6-Sol mostly repairs the wrong code; a reviewer from a second vendor catches about two thirds of a Claude reviewer's misses. Beyond a leaderboard, CyberDual has three uses. First, PoC execution gives both sides a reward that agent reports cannot game, so its surviving attacks can train reviewers against stronger attackers. Second, it can gate a release on both scores: Claude Sonnet 5 refuses one in five attack slots, yet attacks about as well as GPT-6-Sol, so refusal alone does not remove attack capability. Third, it can warn the teams behind a deployed reviewer when a new attacker crosses a threshold: GLM 5.3 in Claude Code already gets an exploit past Sonnet 5 in 17% of its attack slots.

Summary

  • CyberDual is a novel framework simulating a dual-role scenario where AI attackers embed realistic, exploitable bugs into real software maintenance commits while AI reviewers detect and repair these defects in widely used open-source C/C++ projects.
  • The evaluation relies on executing attacker-provided proofs of concept (PoCs) against reviewed code to definitively confirm whether exploits survive or are mitigated, ensuring a reliable, unforgeable performance metric.
  • Three AI reviewers (including Claude Code Sonnet 5 and GPT-6-Sol) catch 85-91% of 1,088 valid attacks generated by six different AI attackers, but approximately one in six attacks, especially those spread over multiple commits, remain undetected and exploit...
  • The strongest AI attacker, GLM 5.3 with open weights, consistently produces attacks that evade reviewer detection more frequently than closed-source models, highlighting the challenges posed by sophisticated open attackers.
  • Many surviving attacks exploit reviewers' tendencies to miss planted code lines or rely solely on existing test suites without running new test inputs; reviewers from a second vendor catch about two-thirds of misses, demonstrating the value of diverse, mult...

The Agent Internet A New Evolutionary Phase of the Web and Its Global Impact

Merged record merged scholarly record OpenAlex Trust and Identity Agent-to-Agent Communication Governance and Policy

A. Shaji George, B.Roshini, Dr.T.Baskar

Published 2026-10-25

Venue: Zenodo (CERN European Organization for Nuclear Research)

DOI: https://doi.org/10.5281/zenodo.23425885

View source

Abstract

Large language model (LLM) based software agents are transitioning from one shot assistants to long term actors that plan, negotiate and accomplish tasks with multiple services. This transformation is resulting in what researchers call the Agent Internet, the Agentic Web or the Internet of Agents, in which programs are full-fledged players alongside people. This article summarizes academic surveys, industry studies and public market data from 2025 to 2026 to outline the multi-layered nature of this setup and to consider its pros and cons. According to market estimates, the revenue for agent software is estimated to be around eight billion dollars in 2025 and up to 35-53 billion dollars in 2030. Adoption statistics tell a tale of much experimentation and few pilots taking it to scale. We discuss communication protocols that enable agents to find and trust each other, the as yet undeveloped identity and payment layers and the burden of agent traffic on advertising supported content. But the challenges that we see are not just capabilities, but security, accountability, interoperability, and who pays for content and compute. Finally, we highlight some of the current research and policy gaps and suggest avenues for a responsible construction.

Summary

  • Large language model (LLM) based software agents are evolving from single-use assistants to autonomous, long-term actors capable of planning, negotiating, and performing tasks across multiple services.
  • This evolution is leading to the emergence of the 'Agent Internet' or 'Internet of Agents', where software agents become active participants alongside humans on the web.
  • Market analysis from 2025-2026 projects agent software revenue to grow from approximately $8 billion in 2025 to between $35 billion and $53 billion by 2030, indicating significant economic potential.
  • Despite broad experimentation, few large-scale deployments have been realized, reflecting challenges in scaling agent technologies.
  • Key enabling technologies include communication protocols that facilitate agent discovery and trust establishment; however, crucial identity and payment infrastructure layers remain underdeveloped.

Agent-to-Agent Synthetic Social Engineering on the Web

arXiv preprint arXiv Trust and Identity Agent-to-Agent Communication Governance and Policy

Bryan C. Boots

Published 2026-10-24

Venue: arXiv

View source

Abstract

An AI agent can prepare an accurate report and still request an action its user has not authorized. Cooperation across Web services therefore requires separate judgments about identity, evidentiary support, and permission. We define synthetic social engineering (SSE) as deliberately deceptive or misleading influence intended to exploit AI recipients' responses to credibility, authority, or obligation cues and redirect behavior away from authorized objectives. We focus on separately tasked sender agents that produce or adapt misleading communication. Drawing on cybersecurity, social engineering, and persuasion research, we develop an operational framework connecting actors, deceptive representations, candidate influence routes, evidence or permission boundaries, responses, and consequences. The framework distinguishes attempts from successful redirection, without assuming human psychological processes. We implement it in the Agent Service Exchange and Evidence Commons (ASE-EC), a reproducible testbed with independently specified records and authorization scopes. Across 1,260 research episodes using Qwen3-4B in two fictional briefing tasks, matched comparisons test authority and commitment appeals, while defense comparisons assess protection alongside authorized task completion. Invoking a limited prior agreement increased unauthorized requests from 43.3% to 96.7%, although recipients retained supported decisions and permissions remained unchanged. These controlled findings identify action selection as a distinct security concern, even when evidence handling succeeds, and they provide a reusable basis for evaluating safeguards that preserve useful cooperation across Web services.

Summary

  • The paper introduces Synthetic Social Engineering (SSE) as deliberately deceptive communication targeting AI agents by exploiting social cues like authority and obligation to induce unauthorized actions.
  • A novel operational framework differentiates identity verification, evidentiary support, and permission scopes to separate legitimate claims from unauthorized requests in multi-agent interactions.
  • An experimental testbed called Agent Service Exchange and Evidence Commons (ASE-EC) enables controlled evaluation of SSE effects using independently specified records and authorization boundaries.
  • Experiments using Qwen3-4B model in two briefing tasks reveal that appealing to prior agreements drastically increases unauthorized requests—from 43.3% to 96.7%—despite unchanged evidentiary support and permissions.
  • Authority cues alone do not significantly reduce unauthorized requests; authentic identity verification and visible provenance are insufficient safeguards against SSE.

Strategic Calibration in LLM Multi-Agent Systems: Audited Pivot Scoring for Truthful Elicitation

Merged record merged scholarly record arXiv Trust and Identity Agent-to-Agent Communication Governance and Policy

Jinhao Zhou, Zhaohan Zhang, Xijian Xu, Jun Wu

Published 2026-10-24

Venue: arXiv

View source

Abstract

In large language model (LLM)-based multi-agent systems, reported confidence increasingly determines the allocation of scarce downstream attention, computation, and decision influence. This makes reporting strategic: an agent may overstate the relevance of its contribution even when its underlying belief is well calibrated. Existing calibration methods largely assume passive reporting and therefore do not address strategic incentives created when confidence determines downstream allocation. We formulate strategic calibration as a reporting-layer incentive problem and propose the Audited Pivot Scoring Mechanism (APSM). APSM offsets platform-controlled allocation benefits, uses inverse-propensity-weighted sparse audits, charges the Clarke pivot externality, and applies a strictly proper score. Under the stated model assumptions, truthful reporting is the unique expected-utility best response. We also characterize approximate execution and the audit-variance trade-off. Calculator-free experiments show that LLM agents inflate confidence under Top-$K$ incentives. With a shared agent-local utility interface, LLM agents reduce distortion under both Compensated Proper Scoring (CPS) and APSM. CPS achieves higher exact allocation match, whereas APSM yields lower Brier loss and numerically fewer cutoff crossings. Experiments further show that APSM enlarges the utility margin against allocation-changing deviations by $1.93\times$ and improves robustness under approximate execution. These results support incentive-aware elicitation as a distinct layer for reliable multi-agent coordination.

Summary

  • LLM-based multi-agent systems use reported confidence scores to allocate scarce downstream resources, creating incentives for agents to strategically over-report confidence to gain advantage.
  • Existing calibration methods assume passive confidence reporting and fail to address strategic distortions when confidence directly influences allocation decisions in multi-agent settings.
  • The paper proposes the Audited Pivot Scoring Mechanism (APSM), which integrates platform-controlled allocation benefits compensation, sparse inverse-propensity-weighted audits, Clarke pivot externality charges, and strictly proper scoring rules to incentivi...
  • Theoretical analysis proves that under APSM, truthful reporting is the unique expected-utility best response for agents, increasing robustness against allocation-changing deviations and approximate execution errors.
  • Empirical experiments with LLM agents in web retrieval and database diagnosis tasks demonstrate that APSM significantly reduces strategic confidence inflation compared to baseline and compensated proper scoring mechanisms (CPS).

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents

arXiv preprint arXiv Trust and Identity Agent-to-Agent Communication

Gejian Zhao, Hanzhou Wu, Xinpeng Zhang

Published 2026-10-23

Venue: arXiv

View source

Abstract

Verifying the provenance of autonomous LLM agents is a critical security challenge. Existing semantic attribution is easily obfuscated by system prompts, while active watermarking conflicts with schema-constrained tool generation. We propose AgentTrace, an active framework that identifies the foundation model behind a black-box agent via observable execution traces. AgentTrace injects structurally ambiguous probes to trigger tokenization-sensitive serialization failures at rigid tool interfaces. While these initial failures provide coarse-grained separation across model families, the temporal sequence of subsequent repair operations reveals fine-grained, model-specific recovery behaviors. By modeling these multi-step trajectories with lightweight Markov chains, AgentTrace achieves 96.0% attribution accuracy under adversarial identity spoofing. Crucially, sequential repair modeling successfully distinguishes the evaluated intra-family variants sharing identical tokenizers (e.g., Llama-3 8B/70B), substantially outperforming unordered behavioral statistics while remaining robust against prompt obfuscation and temperature scaling.

Summary

  • AgentTrace addresses the challenge of verifying the provenance of black-box autonomous LLM agents by analyzing execution-level behaviors rather than relying on semantic outputs or watermarks.
  • The framework injects structurally ambiguous probes that trigger tokenization-sensitive serialization failures in tool interfaces, enabling coarse-grained separation of foundation model families.
  • Fine-grained model-specific attribution is achieved by modeling temporal sequences of repair operations following initial failures using lightweight Markov chains, capturing unique recovery patterns.
  • AgentTrace attains high attribution accuracy of 96.0%, outperforming semantic baselines significantly, and remains robust under adversarial identity spoofing, prompt obfuscations, and varying temperature settings.
  • Experiments were conducted on GPT-4o models and open-weight surrogates like Llama-3, Qwen-2.5, and Mistral, simulating spoofing scenarios where substitutes emulate GPT-4o.

Who Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers

arXiv preprint arXiv Trust and Identity Agent-to-Agent Communication Governance and Policy

William Jeffries

Published 2026-10-23

Venue: arXiv

View source

Abstract

Agents and verifiers often rely on the text a tool prints, and that text can misrepresent what the tool actually did, even when the tool's computation is correct. We saw this happen in a production RAG research system used by the Pilsudski Institute in New York, where tool output formatters misled an agent into giving wrong or incomplete information to users. Each tool did its job correctly, but its output omitted search limits, result caps, or identifier namespaces. We also recreated an unlabeled estimate caught in code review before release. We studied whether these formatters misled agents and verifiers and how much the repaired wording helps. We fed tool results to agents using two formatter versions: one with the key omissions and one with all missing details clearly stated. That difference alone changed what the agents claimed and what the verifiers accepted. Unsupported agent claims dropped substantially for three of the four failure types. In one test, verifiers went from accepting incorrect answers 90 out of 90 times to rejecting them 90 out of 90 times. A control showed the verifiers could catch the errors once they were given the missing facts and asked to judge correctness. We include the audit prompt we used with Codex and Claude Code in an exploratory demonstration, written with prior knowledge of our own system's defects. When pointed at an old version of our own system, it rediscovered the defects that were still live and surfaced twelve more we had not catalogued. When pointed at OpenClaw and Hermes, two of the best-known open-source agentic systems, it found warped formatters in both. We opened PRs to fix both, and the OpenClaw fix has already been merged. Practitioners can run the same prompt on their own systems today.

Summary

  • Agents and verifiers frequently rely on the textual output of tools, which can misrepresent the actual computations if key details are omitted, leading to incorrect or incomplete agent responses.
  • In a production retrieval-augmented generation (RAG) system, output formatters omitted critical information such as search limits, result caps, uncertainty labels, and identifier namespaces, causing agents to overclaim or misrepresent information despite co...
  • Four main formatting defects were identified: scope misrepresentation, incomplete results, unlabeled uncertainty estimations, and unclear provenance of identifiers.
  • Experimental comparison between 'warped' (omission-present) and 'clear' (fully detailed) formatter versions showed that clear wording drastically reduced unsupported agent claims and enabled verifiers to robustly reject incorrect answers.
  • An audit prompt was developed and demonstrated with Codex and Claude Code models to systematically detect warped formatters by comparing textual outputs to actual tool behavior, successfully uncovering both known and previously undocumented defects.

Detecting Insecure Compositions of Clean Agent Skills via Capability-Flow Graph Analysis

arXiv preprint arXiv Orchestration Risk Agent-to-Agent Communication Memory Poisoning

Yihao Li, Chuanpu Fu, Yizhou Zhao, Miao Chen, Qi Li, Ke Xu

Published 2026-10-23

Venue: arXiv

View source

Abstract

AI agents increasingly extend their capabilities by invoking third-party skills, where each skill encapsulates instructions, scripts, and resources for agents to execute on demand. This paper reveals that deploying many benign skills together introduces compositional security risks: multiple individually clean skills can compose into safety-violation chains, because the agent passes an upstream skill's output to a downstream skill's input across invocations. The risk arises not from any single skill, but from the agent's runtime orchestration, and thus cannot be captured by existing malicious skill detection methods. To this end, we develop KnotScryer to detect insecure skill compositions by treating skills as typed capability flows. In particular, we abstract each skill into a capability summary, and construct the Skill Capability-Flow Graph (SCFG), where edges denote cross-skill information flow. Moreover, we design a search policy that tracks protected or untrusted data along handoff edges to locate paths reaching insecure operations. Finally, a two-layer verification method replays the insecure information flow for reachability analysis and applies a task-anchored LLM chain audit to confirm the semantic plausibility of the identified violation chains. We deploy KnotScryer to analyze 13,598 clean skills from ClawHub, and validate the detected chains across three agent frameworks and three LLMs. KnotScryer identifies 612 insecure compositions, which are consistently exploited across agent frameworks. Meanwhile, under GLM-5.1, it outperforms tag-match and graph-only baselines by improving the exploitation rate from 16.5%-18.2% to 85.6%, while reducing the search space by 85.3%. Furthermore, 13.7% of the detected chains consist entirely of skills labeled safe by a single-skill scanner, showing that KnotScryer effectively identifies insecure compositions that per-skill auditing cannot.

Summary

  • AI agents commonly extend functionality by invoking third-party skills, each encapsulating instructions, scripts, and resources.
  • Individually benign skills can compose into insecure chains at runtime, leading to security violations not detectable by single-skill malicious detection methods.
  • KnotScryer is introduced to detect insecure skill compositions by creating a Skill Capability-Flow Graph (SCFG) that models typed input-output relationships and capability flows between skills.
  • The system abstracts skills into detailed capability summaries capturing inputs, outputs, operations, context exposure, and trust boundaries for precise cross-skill reasoning.
  • A policy-guided graph search tracks protected or untrusted data through skill handoffs to locate paths that reach insecure operations or forbidden sinks according to defined security policies.

Estimation of Propagated Risk in LLM-based Multi-Agent Systems

Merged record merged scholarly record arXiv Agent-to-Agent Communication Orchestration Risk Benchmarks and Evaluation

Shreyan Ganguly, Souradeep Chattopadhyay, Qisai Liu, Soumik Sarkar

Published 2026-10-23

Venue: arXiv

View source

Abstract

Large Language Model (LLM) based multi-agent systems introduce a distinctive reliability challenge in which actions taken by upstream agents can affect the correctness of downstream agents. While prior work has investigated error propagation and developed methods for estimating uncertainty inherited from upstream agents, existing approaches do not explicitly model how realized sender-receiver interactions contribute to downstream error risk under different sender correctness states. In this work, we study agent-level error-risk estimation from multi-agent execution traces. We propose Interaction-Effect Propagation (IE-Prop), an interaction-conditioned model that learns separate effects for correct and incorrect upstream agents. For each sender-receiver interaction, the model combines these conditional effects using the sender's estimated error risk, and recursively propagates the resulting risk estimates through the execution graph. We evaluate our approach across three multi-agent architectures and three benchmarks. Across all evaluated architectures, our approach raises the final-node AUROC over the established baseline by approximately 0.05 points on average. Furthermore, tracking risk across multiple agent steps contributes a distinct +0.03 AUROC gain in sequential systems. These results show that realized inter-agent interactions provide predictive information beyond receiver-local evidence, while the value of multi-step risk tracking depends on the system's information-flow structure.

Summary

  • LLM-based multi-agent systems face unique reliability challenges due to error propagation where upstream agent actions influence downstream agent correctness in complex ways beyond monotonic error assumptions.
  • The paper introduces Interaction-Effect Propagation (IE-Prop), a novel interaction-conditioned model that separately learns the influence of correct and incorrect sender agents on receiver error risk, incorporating sender correctness uncertainty for recursi...
  • Multi-agent interactions are modeled as directed acyclic graphs with error risk computed through a logistic framework that adjusts receiver likelihoods based on sender correctness-conditioned interaction effects, enabling refined error-risk propagation.
  • IE-Prop is trained end-to-end on multi-agent execution traces using cross-entropy loss, optimizing both local risk predictors and interaction effect models to accurately estimate downstream error probabilities.
  • Evaluation across three multi-agent architectures (sequential, fully connected, hierarchical) and three benchmarks (GSM8K, MedQA, WebQA) demonstrates improved final-node AUROC over multiple baselines, confirming the benefit of modeling realized interactions...

WAFGen: LLM Agents for IDS and Multi-Cloud WAF Rules Generation

OpenAlex · Research Square repository OpenAlex Agent-to-Agent Communication Governance and Policy Benchmarks and Evaluation

Anes Abdennebi, Nadjia Kara, Hakima Ould‐Slimane

Published 2026-10-23

Venue: Research Square

DOI: https://doi.org/10.21203/rs.3.rs-11273238/v1

View source

Abstract

Abstract unavailable from OpenAlex metadata.

Summary

  • WAFGen is a multi-LLM fine-tuning pipeline designed to automatically generate intrusion detection system (IDS) and multi-cloud web application firewall (WAF) rules across AWS, Azure, and Cloudflare, addressing the complexity and diversity of manual rule cre...
  • The system introduces Single-platform and Multi-platform adapters trained on open-source threat corpora, achieving over 90% syntactic validity and strong cross-provider generalization, with multi-platform training improving rule correctness and acceptance r...
  • Four pre-trained base models (ranging from 1.7B to 7B parameters) were fine-tuned using supervised learning with low-rank adapters, demonstrating that larger models like Mistral-7B and CodeLlama-7B outperform smaller ones in rule generation quality.
  • WAFGen integrates cost estimation via AWS Web ACL Capacity Units (WCU), enabling generation of cost-effective WAF rules that reduce ACL capacity costs by up to 28x compared to AWS managed rule sets, while keeping WCU budgets manageable.
  • Live deployment evaluations against real cloud provider APIs validated generated WAF rules with over 90% acceptance rates and suitable latency, confirming operational viability for interactive tooling and cloud security workflows.

Accompanying artifact package for the paper "Preview-Based Goal-Aware Runtime Enforcement for LLM Agents"

OpenAlex · Zenodo (CERN European Organization for Nuclear Research) repository OpenAlex Agent-to-Agent Communication Governance and Policy

Anonymous, Anonymous, Anonymous, Anonymous

Published 2026-10-23

Venue: Zenodo (CERN European Organization for Nuclear Research)

DOI: https://doi.org/10.5281/zenodo.23596969

View source

Abstract

Here there are the software artifacts for the 6 scenarios showing the PGA enforcement strategy for the LLM-based Medication Assistance System. These artifacts consist of an archive file AgenticPillbox.zip containing the composition tool AsmetaComp.jar file, all the ASM models (files .asm) and simulation scripts (files .asmsh) to reproduce the validation scenarios presented in the paper. High-level directory structure AgenticPillbox.zip: AsmetaComp.jar -> AsmetaComp .jar, ASM compositional simualtion tool of ASMETA PGA_version/ ->Folder with models and scripts (files .asmsh) for the PGA enforcement protocol M1_C_PGA.asmsh-> Script of Scenario M1 with enforcement startegy PGA M2_PGA_residual_compatible.asmsh, M2_PGA_residual_conflict.asmsh, M2_PGA_transient_conflict.asmsh-> Scripts of Scenarios M2 with enforcement startegy PGA ASM models: scheduler.asm (renamed original rescheduler.asm), pillbox.asm, PreviewCoordinator.asm (NEW!), pillboxPreview.asm (NEW!), and the unmodified companion models (knowledge.asm, configurationMgr.asm, compartment.asm, StandardLibrary.asm) traces/ -> Folder with all simulation trace logs (files .txt) for comparison ASM models: scheduler.asm (renamed original rescheduler.asm), pillbox.asm, and the unmodified companion models (knowledge, configurationMgr, compartment, StandardLibrary) M1_rescheduling_v2_input_fix.asmsh-> Script of scenario M1 M1_rescheduling_v2_input_fix2.asmsh-> Script of scenario M2 ASM models changes from the original MRM case study (https://doi.org/10.5281/zenodo.18678488). Scheduler (renamed original rescheduler.asm): - original missed/late-dose enforcement rules from the MRM retained; - model receives structured requests and candidate preview results; - new WAIT_PREVIEW -> WAIT_COMMIT -> IDLE protocol; - ALLOW or REPLACE is reported only on command ACK (lastAppliedCommandId); - unique nonzero agentRequestId used as commandId; - scheduleVersion, lastAppliedCommandId and lastRejectedCommandId are monitored directly, matching Pillbox OUT signatures.Pillbox: - applies agent commands to targetDoseIndex, not current drugIndex; - rejects stale, past, or out-of-bounds commands; - deduplicates repeated commandId values per compartment; - increments scheduleVersion once per simulation step for schedule updates. How to run the scenarios (requires Java installed!) Extract the ZIP file into a new directory. Start a shell in that new directory. Run the command: java -jar AsmetaComp.jar .asmsh Commands lines ready to run: java -jar AsmetaComp.jar M1_rescheduling_v2_input_fix.asmshjava -jar AsmetaComp.jar M1_rescheduling_v2_input_fix2.asmshjava -jar AsmetaComp.jar PGA_version/M1_C_PGA.asmshjava -jar AsmetaComp.jar PGA_version/M2_PGA_residual_conflict.asmshjava -jar AsmetaComp.jar PGA_version/M2_PGA_transient_conflict.asmshjava -jar AsmetaComp.jar PGA_version/M2_PGA_residual_compatible.asmsh

Summary

  • The paper provides software artifacts supporting six scenarios that demonstrate the Preview-Based Goal-Aware (PGA) enforcement strategy applied to a large language model (LLM)-based Medication Assistance System.
  • Artifacts include ASM (Abstract State Machine) models, simulation scripts, and the AsmetaComp.jar tool to compose and simulate the models, enabling reproduction of the validation scenarios.
  • Modifications to the original Medication Reminder Model (MRM) case study include enhancements to the scheduler model to handle structured requests, candidate previews, and a protocol transitioning through WAIT_PREVIEW, WAIT_COMMIT, and IDLE states.
  • The PGA enforcement protocol in the scheduler evaluates commands only upon acknowledgment, using unique agentRequestIds to manage command identities and tracking schedule versions along with last applied and rejected command IDs.
  • The pillbox model applies commands precisely to target doses, rejects invalid or stale commands, removes duplicates, and updates schedule versions after each simulation step to maintain consistency.

Governed Self-Evolution for Autonomous Investing: A Multi-Agent LLM System with an Invariant Core

arXiv preprint arXiv Governance and Policy Agent-to-Agent Communication Trust and Identity

Yebo Feng, Jingyang Dai, Liangrui Pan, Nelson Lau, Jiahua Xu, Yang Liu

Published 2026-10-22

Venue: arXiv

View source

Abstract

LLM agents that act on live Web data must combine heterogeneous evidence, remember what they have done and improve from outcomes without weakening their own safeguards. We study this problem in autonomous investing, where every action is irreversible and based on untrusted Web content. We present Steward, a multi-agent LLM system that draws the boundary of self-evolution in its type system. First, nine role-specialised agents decide jointly: four analysts read news feeds, SEC filings, macroeconomic series and market data and emit typed reports, from which a Portfolio Manager sets target positions that a protected Risk Manager audits. Second, a seven-layer shared memory, assembled by code from the system's own record, gives each decision its position context, the market narrative, calibration and the agent's past decisions. Third, the system improves itself by review: code grades every trade and forecast nightly and writes the grades into memory, and each quarter a reflector proposes prompt learnings that a deterministic gate applies reversibly and replay of recorded inputs verifies. All three operate around an invariant core of order arithmetic, risk rules and discipline-agent prompts that no self-edit can reach. In a five-month live deployment (102 trading days, 1,632 LLM calls), the system contained a 24.6% sector drawdown to a 0.3% loss; in replay of its recorded inputs, a single model given the same raw data traded more and lost 1.35 points against the market over five days where the joint design showed no significant loss, and no injected instruction was followed; and a 2015-2026 backtest shows the core alone lowering the maximum drawdown under all 50 random entry policies. The reflector traced the dominant failure to its root cause, and the gate applied a learning that the agent adopted on trigger evenings and on no control evening. Code: https://github.com/yebof/quant-agent

Summary

  • The paper presents Steward, a multi-agent large language model (LLM) system for autonomous investing that integrates live web data with stringent self-governance to ensure safe self-evolution without compromising risk discipline.
  • Steward employs nine specialized agents—including four analysts (news, SEC filings, macroeconomic data, market data), a Portfolio Manager, and a Risk Manager—that cooperate via a shared seven-layer memory system containing contextual and historical decision...
  • Governed self-evolution is realized through a nightly graded review of trades and forecasts, a quarterly Meta Reflector proposing prompt improvements, and a deterministic gating mechanism that preserves an invariant core of order arithmetic, risk rules, and...
  • The invariant core safeguards the system’s integrity by preventing unauthorized self-modification, enforcing strict risk limits, and rejecting malicious or unsafe instructions derived from untrusted web inputs, ensuring robust security.
  • In a five-month live deployment with 102 trading days and 1,632 LLM calls, Steward demonstrated strong performance by limiting sector drawdown to 24.6% and overall loss to 0.3%, outperforming a single-model baseline that lost 1.35 points compared to the mar...

UniGuard: Multi-View Guardrail Learning for Cross-Interface Safety Generalization

arXiv preprint arXiv Prompt Injection Agent-to-Agent Communication Benchmarks and Evaluation

Viet-Thanh Pham, Thuy-Trang Vu, Junae Kim, Rollin Omari, Dinh Phung, Gholamreza Haffari, Lizhen Qu

Published 2026-10-22

Venue: arXiv

View source

Abstract

Guardrail models are increasingly used as safety layers for LLMs and agentic systems, but most are trained on fixed prompt or response interfaces and become unreliable when the same safety case appears as a conversation, agent trajectory, multi-agent trace, or policy-conditioned input. We propose UniGuard, a training framework that learns interface-invariant safety representations from multiple semantically aligned views of the same safety case. We also construct the UniGuard-FT dataset by transforming 1,000 public safety cases into prompt, response, multi-turn conversation, agent-trace, and multi-agent-trace views, and train UniGuard-0.6B with classification, supervised contrastive learning, and asymmetric confidence calibration losses. Across unseen-interface benchmarks ATBench, PolicyGuardBench, and DynaBench, UniGuard-0.6B improves over its pretrained guardrail by 45.12 F1 points on average and reduces expected calibration error by 35.41 points, while remaining competitive with much larger guardrails such as Claude-Sonnet-4.5 and GPT-5.2 - despite being a 0.6B model and trained only with synthetic data.

Summary

  • UniGuard addresses the challenge of cross-interface safety generalization in multi-agent systems by learning interface-invariant safety representations.
  • The framework introduces multi-view guardrail learning using semantically aligned views of safety cases, including prompts, responses, conversations, agent traces, and multi-agent traces.
  • A novel dataset, UNIGUARD-FT, is constructed by transforming 1,000 public safety cases into multiple interface formats to support multi-view training and evaluation.
  • Training involves a multi-objective approach combining supervised classification, supervised contrastive learning for aligning representations across views, and asymmetric confidence calibration to improve model reliability and reduce overconfidence.
  • UniGuard-0.6B, a compact 600M parameter model trained on synthetic data, significantly outperforms its pretrained guardrail and competes with much larger models like Claude-Sonnet-4.5 and GPT-5.2 on safety detection benchmarks.

LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades

Merged record merged scholarly record arXiv Trust and Identity Agent-to-Agent Communication Orchestration Risk

Farnoosh Hashemi, Shiyu Ji, Joice Chen, Michael W. Macy

Published 2026-10-22

Venue: arXiv

View source

Abstract

Large language models (LLMs) increasingly operate in multi-agent systems where they collaborate by responding to others' choices, creating endogenous feedback loops with vulnerability to social influence, herding behavior and runaway cascades. Following the design of the classic Music Lab experiment, we tested this vulnerability in large populations of LLM agents that recommended unfamiliar songs, with or without exposure to cumulative recommendation counts. Exposure led to runaway cascades that generated extreme and unpredictable collective recommendations increasingly divergent from a song's intrinsic appeal. Compared to humans, LLM populations were generally far more susceptible to herding behavior, and unlike humans, LLM cascades were less able to self-correct. This vulnerability has implications for multi-agent collaboration in recommender systems, automated evaluation, complex problem-solving, and unauthorized conspiracies.

Summary

  • The paper examines vulnerabilities of large language model (LLM) multi-agent systems to social influence, herding behavior, and runaway cascades using a music recommendation task modeled after the Music Lab experiment.
  • LLM populations recommending unfamiliar songs, when exposed to cumulative recommendation counts (social signals), exhibit extreme and unpredictable collective preferences diverging from intrinsic item appeal.
  • The study tests three conditions—independent (no social signal), weak influence (counts shown, random order), and strong influence (counts shown with popularity ordering)—to evaluate feedback loop effects on recommendation dynamics.
  • Thirteen different LLM models, including reasoning and non-reasoning types, participate in multiple parallel simulation worlds with agents characterized by personas reflecting demographics and music preferences.
  • Compared to human data, LLM populations are more susceptible to herding and show less capability for self-correction in popularity-based cascades, leading to persistent misalignment between popularity and intrinsic appeal.

Muffin - A Shared Memory Buffer for Asynchronous AI Agents

Merged record merged scholarly record arXiv Agent-to-Agent Communication Memory Poisoning

Ping-Lin Kuo, Suman Navaratnarajah, Christian Frey, Gresa Shala, Josif Grabocka

Published 2026-10-22

Venue: arXiv

View source

Abstract

The rise of Agentic AI systems has changed the landscape of artificial intelligence by enabling strong reasoning capabilities through specialized multi-agent interaction with structured self-reflection. However, in target-driven reasoning tasks, single- and multi-agent systems are often on par in terms of performance gains. A major challenge is that failures often arise from an ineffective exchange of critical information during inter-agent interaction and coordination. Different from existing multi-agent debate paradigms that rely on synchronous turn-taking and sharing information across different agents, we propose an inter-agent protocol based on shared Memory bUFFer INference - referred to as MUFFIN - in an asynchronous agentic framework. In the first step, an orchestrator routes queries based on their reasoning demands and delegates demanding ones to a multi-agent setting, where a shared memory buffer provides asynchronous exchange of intermediate findings while an agent's private reasoning remains local. Our experiments show that our framework Muffin outperforms established competitors, achieving the best accuracy in 17 out of 20 of our benchmark settings, and provides a better quality-cost trade-off than multi-agent debate: Muffin improves accuracy by 19.2 accuracy points while using 77.4% fewer tokens, without requiring full-trace sharing.

Summary

  • Introduces Muffin, a novel asynchronous multi-agent AI framework leveraging a shared memory buffer for selective exchange of intermediate reasoning, improving coordination among agents while preserving private processes.
  • Employs an orchestrator language model that assigns queries to either single-agent or specialized multi-agent setups, distributing roles and subtasks to optimize reasoning efficiency.
  • Muffin’s shared append-only memory buffer allows agents to asynchronously write and read compact intermediate findings, avoiding synchronous turn-taking and reducing communication overhead.
  • Demonstrates substantial performance gains over established baselines including single-agent, majority vote, and multi-agent debate systems across 20 diverse reasoning benchmarks.
  • Achieves an average accuracy improvement of 19.2 points while using 77.4% fewer tokens than synchronous multi-agent debates, highlighting an improved accuracy-cost trade-off by avoiding full-trace sharing.

Mining the Design Space of Multi-Agent Workflows

Merged record merged scholarly record arXiv Memory Poisoning Orchestration Risk Agent-to-Agent Communication

Xavier Cadet, Junyan Cheng, Peter Chin, Kyle Richardson

Published 2026-10-22

Venue: arXiv

View source

Abstract

Designing large language model (LLM) multi-agent systems (MAS) still relies on trial and error and informal "folk wisdom." Manual studies test only a few communication structures or topologies (e.g., sequential, parallel, shared-memory, or debate), while automated optimizers discard search trajectories after selecting a task-specific workflow. We present a two-phase pipeline for mining reproducible design principles from workflow code and execution traces. We repurpose AFlow's MCTS optimizer across six composable operators and 26 deterministically verified Enigmata tasks, retaining all intermediate rounds to build a corpus of 28,568 executable workflows. A sandboxed AutoResearch loop then mines orchestration code and prompt templates under an $L_0$-penalized validation objective and tests candidate principles on held-out searches. Across 300 feature-mining trials, we identify effects that persist on held-out searches across three levels of workflow design: workflows beginning with independent solvers and one-shot aggregation (Star-first) perform worse ($Δ= -0.045$); persistent shared documents (SharedMemory) outperform debate ($Δ= +0.135$); and prompt specificity and placeholder-based context routing yield gains comparable to communication-structure selection ($Δ= +0.118$). More broadly, our pipeline and results show the feasibility of turning discarded search trajectories into a statistical testbed for discovering and validating multi-agent workflow design principles.

Summary

  • Current design of multi-agent systems (MAS) using large language models (LLMs) lacks systematic principles, relying mostly on trial-and-error and informal knowledge.
  • The authors developed a two-phase pipeline that mines full search trajectories (over 28,000 workflows across 26 deterministic reasoning tasks) generated by a Monte Carlo Tree Search (MCTS) optimizer to extract reproducible MAS design principles.
  • Six fundamental operator primitives (Sequential, Star, Debate, SharedMemory, StarWithCoordinator, DebateWithModerator) were defined, representing distinct communication structures for composing MAS workflows as executable Python programs.
  • Key findings include that workflows starting with star-like independent solvers followed by one-shot aggregation perform worse; shared-memory communication (persistent shared documents) outperforms debate-style interaction; and richer prompt specificity wit...
  • The pipeline integrates automated feature mining (AutoResearch) and statistical validation using L0-penalized regression and cluster-robust inference to identify workflow and prompt features predictive of performance.

Ulysses: A Security Harness For Synthesizing Verifiable Web Exploits

arXiv preprint arXiv Benchmarks and Evaluation Agent-to-Agent Communication Orchestration Risk

Aditya Oke, André Vicente Duarte, Rui Melo, Shubham Gandhi, Nachiket Kotalwar, Charmi Khandor, Danqing Wang, Carolyn Rosé

Published 2026-10-22

Venue: arXiv

View source

Abstract

How can an AI agent automatically discover security vulnerabilities in any software repository? Existing approaches use LLMs to generate software vulnerability exploits. However, it is challenging for an LLM to reliably verify its own generated exploits. In this paper, we propose Ulysses, a multi-agent security harness to synthesize verifiable vulnerability exploits for web applications. Ulysses converts candidate vulnerability findings into verified Proofs of Exploitability by iteratively exploring exploit hypotheses and establishing success in independently observed execution effects. We evaluated Ulysses on WebExploitGym, a curated benchmark of exploitable instances from 25 real-world web applications that span 5 languages and 7 frameworks. Ulysses produces verified proofs for 10 of 25 real-world advisories. It also discovered 4 new proofs of exploitability that have never been previously reported.

Summary

  • ULYSSES is a multi-agent framework designed to automatically generate verifiable Proofs of Exploit (PoE) for web application vulnerabilities by iteratively exploring and validating exploit hypotheses on live targets.
  • Unlike previous approaches relying on LLMs that generate but cannot reliably verify exploits, ULYSSES uses an independent Effect Oracle to confirm actual exploit success through observable side effects, ensuring trustworthy verification beyond model self-as...
  • The system was evaluated on WEBEXPLOITGYM, a benchmark of 25 real-world web applications spanning multiple languages and frameworks, where it produced verified proofs for 10 known advisories and discovered 4 previously unknown exploits, highlighting its pra...
  • ULYSSES combines static or advisory-based input with a planning-reflection loop to efficiently localize vulnerabilities and synthesize actionable exploits, which improves over zero-knowledge scenarios that are less effective in directing exploration.
  • Its architecture separates vulnerability detection from exploit verification using multiple cooperating agents that synthesize payloads, execute HTTP requests, and analyze outcomes with an independent oracle to prevent false positives from guesswork or brut...

Knowing Whom to Trust is not Enough: The Trust--Agreement Gap in Repeated Multi-Party LLM Negotiation

Merged record merged scholarly record arXiv Trust and Identity Agent-to-Agent Communication

Amit Sarker, Moumita Choudhury, Saaduddin Mahmud, Shlomo Zilberstein

Published 2026-10-22

Venue: arXiv

View source

Abstract

Large language model (LLM) agents increasingly participate in negotiations on behalf of individuals and organizations, yet they remain vulnerable to manipulation, particularly in repeated multi-party interactions. Classical multi-agent systems address this challenge through explicit trust and reputation models, whereas existing work on LLM negotiation largely treats trust as an emergent phenomenon. We investigate whether LLM agents can form useful trust estimates from prior interactions and leverage them to improve future negotiation outcomes. We introduce a repeated, multi-party, multi-issue negotiation framework in which recurring agents participate in a sequence of negotiation games while one participant covertly attempts to prevent agreement. After each game, agents assess their counterparts and maintain pairwise trust estimates that carry over to subsequent negotiations. We compare trust-aware and trust-agnostic agents and analyze how explicit trust influences negotiation outcomes. Our results reveal a \emph{trust--agreement gap}: trust-aware agents can identify the adversary within a few games, but accurate trust estimates do not consistently translate into better agreements. Trust increases agreement rates by up to 23 percentage points, but only when agents are explicitly guided to use it in their decisions. Explicit trust can therefore improve repeated LLM negotiations, but its value depends critically on how trust is assessed and incorporated into agents' reasoning.

Summary

  • The paper addresses vulnerabilities in repeated multi-party negotiations involving large language model (LLM) agents, focusing on the challenge of manipulation by adversarial participants.
  • It introduces TASMAN, a novel repeated multi-party, multi-issue negotiation framework where agents form and update explicit trust estimates based on prior interactions, comparing trust-aware and trust-agnostic strategies.
  • Multiple trust assessment methods are evaluated, including Beta Reputation System (BRS), rubric-based metrics quantifying behavioral attributes, and free-form LLM-generated assessments.
  • Results reveal a 'trust–agreement gap': although agents can accurately identify adversaries through trust estimates, this trust does not automatically lead to better negotiation outcomes unless explicitly integrated into decision-making processes.
  • Explicit guidance on how to incorporate trust into agents' reasoning ('underprescriptive' guidance) significantly enhances agreement rates, surplus, and reduces rejections, highlighting that trust utility depends on its operationalization.

Agentic AI Defense: Decode-Time Provenance Binding for MCP

arXiv preprint arXiv Prompt Injection Trust and Identity Agent-to-Agent Communication

Eric Yocam, Varghese Vaidyan, Paris Kalathas, Patrick Tague, Bruce DeBruhl, Yong Wang

Published 2026-10-22

Venue: arXiv

View source

Abstract

Agentic AI systems using the Model Context Protocol (MCP) are vulnerable to indirect prompt injection through untrusted tool outputs. We demonstrate cross-modal trust laundering, in which instructions concealed in an email-signature image using least-significant-bit (LSB), discrete cosine transform (DCT), or metadata steganography bypass text scanners and enter a multi-agent workflow when decoded by a tool. To counter this threat, we propose decode-time provenance binding, which combines HMAC-authenticated trust labels with an MCP-maintained provenance ledger and context-taint tracking. The mechanism labels decoded content as untrusted and blocks critical tool calls influenced by that content, even when a compromised agent substitutes a valid trusted label. We evaluate the approach using a real MCP testbed with three steganographic carriers and 24 adaptive payloads. The undefended pipeline exhibits 100% attack success, while keyword and regex defenses each permit 62.5% of attacks. Our mechanism blocks all attacks (0% success), including adversarial label substitution across mediated agent boundaries. A four-component ablation validates the roles of decode marking, cryptographic authentication, lineage tracking, and sink enforcement. An audited trusted-promotion mechanism increases legitimate-task completion from 67% to 100% without compromising protection. The approach provides carrier-independent containment within fully mediated MCP execution environments. Code and data are publicly available.

Summary

  • Agentic AI systems using the Model Context Protocol (MCP) are vulnerable to indirect prompt injection attacks via hidden instructions embedded in multi-modal data like email-signature images using steganography techniques.
  • Cross-modal trust laundering allows attackers to bypass traditional text-based defenses by hiding malicious instructions in image carriers, which are decoded downstream by workflow tools in multi-agent MCP systems.
  • The authors propose decode-time provenance binding, a defense mechanism that cryptographically labels decoded content as 'Untrusted' at the moment of concealment reversal, maintaining a secure provenance ledger and context-taint tracking to enforce trust po...
  • This mechanism blocks critical tool calls influenced by untrusted decoded content, preventing attackers from forging valid trusted labels or substitution attacks even when agents are compromised.
  • Experimental evaluation on a realistic MCP testbed with diverse steganographic carriers and adaptive payloads demonstrates that the defense reduces attack success from 100% (without defense) to 0%, outperforming keyword scans, regex parsers, and taint analy...

AI Digital Twin for Cloud Cyber Security

Merged record merged scholarly record OpenAlex Agent-to-Agent Communication Orchestration Risk Governance and Policy

Umesh Samarth, Himanshu Dipak Khade, Aniruddha Baban Shendre, Mayur Vijay Sawarbandhe, Aniket Mahadev Bendarkar

Published 2026-10-22

Venue: International Journal for Research in Applied Science and Engineering Technology

DOI: https://doi.org/10.22214/ijraset.2026.84965

View source

Abstract

The key advantage of cloud computing is scalability and flexibility of infrastructure, however, the growing complexity of cloud environments has led to numerous security issues. Current security systems are largely reactive, which means that any detected attacks have already taken place. This paper suggests the use of the AI-based Digital Twin technology for cybersecurity in cloud environments, providing the possibility of creating a virtual copy of the cloud environment that can be used for continuous monitoring, attack simulation, and security testing. The proposed framework uses AI/ML algorithms for anomaly detection, attacks' classification, and risk assessment in conjunction with Multi-Agent Reinforcement Learning (MARL) in order to achieve collaboration and adaptability of security response. The system includes cloud resource monitoring, attacks simulation, security logging, alert generation, access control by roles, and security analysis dashboard. The development of the system takes place using MERN stack architecture with Digital Twin synchronization of virtual cloud resources and their metrics. With the combination of Digital Twin technology, AI-based threat detection and multi-agent decision making, the proposed framework can provide enhanced proactivity,adaptiveness, and real-time performance of cybersecurity in cloud environments.

Summary

  • Cloud computing's scalability brings complex security challenges that reactive systems fail to address effectively.
  • The paper introduces an AI-driven Digital Twin framework creating a virtual replica of cloud environments for continuous monitoring, attack simulation, and security evaluation.
  • AI/ML algorithms, including Random Forest, Decision Tree, XGBoost, and Isolation Forest, are used for anomaly detection, attack classification, and risk assessment within the Digital Twin.
  • Multi-Agent Reinforcement Learning (MARL) facilitates collaborative and adaptive security responses through multi-agent decision-making in the cloud environment.
  • The system architecture incorporates MERN stack technologies to integrate Digital Twin synchronization with virtual cloud resource metrics.

Privacy Preference Controls for Agentic Systems

Merged record merged scholarly record arXiv Governance and Policy Agent-to-Agent Communication Trust and Identity

Shreya Kochar, Peeranat Sugsavanvit, Vidur Gupta, Joseph A. Calandrino, Deepak Kumar, Brett Frischmann, Sebastian Zimmeck

Published 2026-10-21

Venue: arXiv

View source

Abstract

In response to vast and widespread online tracking, regulators and technologists alike have worked to develop laws and tools that allow people to express their privacy preferences. These measures seek to offer users greater control over the sale and sharing of personal information, putting agency in their hands to protect their privacy. However, the web is undergoing a seismic shift, away from strictly \textit{user-driven} behavior towards \textit{agentic behavior}, where AI agents take autonomous actions on behalf of users. In this study, we ask: What should privacy preference controls look like in the agentic web and agentic systems more generally? To answer this question, we develop a taxonomy of enforceable privacy preferences for agentic systems. Our taxonomy is informed both by laws and empirical studies of existing privacy tools as well as an audit of 30 leading AI assistants and agent platforms. To explore how our taxonomy can be implemented, we design and develop eight open-source prototypes that mirror real-world agentic applications and demonstrate how major aspects of our taxonomy can be structurally integrated in agentic protocols, such as the Model Control Protocol and Agent2Agent protocol. Ultimately, our study seeks to provide the groundwork for ensuring end-user privacy and autonomy is not lost in the newly arriving agentic world.

Summary

  • The paper addresses privacy challenges in AI agentic systems where autonomous agents act on users' behalf, necessitating new privacy preference controls distinct from traditional user-driven web models.
  • A comprehensive taxonomy of enforceable privacy preferences for agentic systems is developed, informed by legal frameworks, empirical studies, and an audit of 30 leading AI assistants and platforms from 22 companies.
  • The taxonomy categorizes privacy controls across the agentic task lifecycle, including agent presence, data collection, usage, persistence, and autonomy, emphasizing data minimization and respect for user autonomy.
  • An empirical audit identifies 32 candidate privacy controls, refined to 24 key enforceable preferences including user consent for agent activation, limits on data sharing and retention, and human review controls.
  • Eight open-source prototype implementations demonstrate the practical integration of these privacy controls into agentic protocols such as the Model Control Protocol (MCP) and Agent2Agent (A2A) protocol, validating their feasibility without impairing user e...

Privacy Preference Controls for Agentic Systems

Merged record merged scholarly record arXiv Governance and Policy Agent-to-Agent Communication

Shreya Kochar, Peeranat Sugsavanvit, Vidur Gupta, Joseph A. Calandrino, Deepak Kumar, Brett Frischmann, Sebastian Zimmeck

Published 2026-10-21

Venue: arXiv

View source

Abstract

In response to vast and widespread online tracking, regulators and technologists alike have worked to develop laws and tools that allow people to express their privacy preferences. These measures seek to offer users greater control over the sale and sharing of personal information, putting agency in their hands to protect their privacy. However, the web is undergoing a seismic shift, away from strictly user-driven behavior towards agentic behavior, where AI agents take autonomous actions on behalf of users. In this study, we ask: What should privacy preference controls look like in the agentic web and agentic systems more generally? To answer this question, we develop a taxonomy of enforceable privacy preferences for agentic systems. Our taxonomy is informed both by laws and empirical studies of existing privacy tools as well as an audit of 30 leading AI assistants and agent platforms. To explore how our taxonomy can be implemented, we design and develop eight open-source prototypes that mirror real-world agentic applications and demonstrate how major aspects of our taxonomy can be structurally integrated in agentic protocols, such as the Model Control Protocol and Agent2Agent protocol. Ultimately, our study seeks to provide the groundwork for ensuring end-user privacy and autonomy is not lost in the newly arriving agentic world.

Summary

  • The paper addresses the challenge of ensuring user privacy in the emerging agentic web, where AI agents autonomously act on users' behalf rather than through direct user interactions.
  • A novel taxonomy of enforceable privacy preferences for agentic systems is developed, informed by privacy laws, empirical studies, and an extensive audit of 30 leading AI assistants and agent platforms.
  • The taxonomy categorizes privacy controls into five key areas: Presence (agent activation), Collection (data types collected), Secondary Use (data sharing and use beyond primary task), Persistence (data retention), and Autonomy (degree of agent decision-mak...
  • Empirical audit reveals current AI products partially implement these privacy controls but show gaps, especially regarding opt-outs for data sale, analytics, and human review, as well as inconsistent defaults and retention periods.
  • Eight open-source prototype implementations demonstrate practical integration of privacy preferences within agentic communication protocols like the Model Control Protocol (MCP) and Agent2Agent (A2A), showing feasibility without major utility loss.

Agentic Architecture of Information Systems. The AAM/5C Model: A Reference Model for Distributed Autonomy

arXiv preprint arXiv Governance and Policy Orchestration Risk Agent-to-Agent Communication

Laurent Goujon

Published 2026-10-21

Venue: arXiv

View source

Abstract

Large organizations increasingly face what this book calls the cognitive complexity wall: at the scale of hundreds of interacting components, maintaining the dependency map and reacting at the pace of incidents exceeds what a human team can deliver. This conceptual volume proposes AAM/5C, in which five capabilities (Capture, Comprehend, Choose, Coordinate, Control) are instantiated across seven logical layers, L1 to L7. A single authorization rule, R-AUT, separates who proposes, who decides and who executes: a probabilistic planner (L4) proposes; a governance layer (L6) decides under signed policies and records its verdict in a signed evaluation proof; a security layer (L5) issues a short-lived act token bound to that proof; a policy enforcement point verifies both before the target layer materializes the act. Under an explicit guarantee contract, two analytical statements (H7a, H8a) hold by construction. The other statements of its ten hypotheses (H1 to H10), including log completeness (H7b) and non-bypass of the enforcement point (H8b), are refutable, and the protocol that could refute them is fixed before any measurement. The contribution of the book is a prescriptive reference model that articulates, under this single authorization rule, known mechanisms and adds three constructs, all to be validated: the Validation step of the Distributed Autonomy Loop, the ephemeral authority surface and the cognitive dependency plane. The book positions them against autonomic computing, multi-agent systems, enterprise architecture and agent protocols (MCP, A2A), gives an authorization policy in Rego and a partial TLA+ specification of peer consensus, and sets out a validation program with quantified milestones. It reports no empirical results. This English edition is a translation of the French original, produced with the assistance of AI tools and validated by the author.

Summary

  • The paper introduces the AAM/5C (Autonomic Architecture Model / 5 Capabilities), a prescriptive reference model for distributed autonomy in large-scale Information Systems, addressing the cognitive complexity wall faced by organizations managing hundreds of...
  • AAM/5C defines five core agentic capabilities—Capture, Comprehend, Choose, Coordinate, Control—applied across seven logical layers (L1 to L7) that encompass sensing, cognition, governance, and execution.
  • A central principle is the strict authorization rule (R-AUT) ensuring that autonomous actions proposed by probabilistic planners (L4) are authorized deterministically by governance layers (L6) and enforced securely by policy enforcement points, thereby sepa...
  • The model introduces novel constructs including the ephemeral authority surface, cognitive dependency plane, and a Validation step in the Distributed Autonomy Loop, enhancing explainability, governance, and security in agent actions.
  • Governance is embedded by design, aligning with regulatory frameworks such as the EU AI Act, and incorporating mechanisms for auditability, policy compliance, reversibility of autonomous acts, and prevention of unauthorized bypass.

Secure Agentic AI and Multimodal Intelligence in 6G Communication Systems

arXiv preprint arXiv Orchestration Risk Agent-to-Agent Communication Memory Poisoning

Satyam Gaba, Devanshu Motwani, Siva Sai, Vineet Suri, Vikas Ranjan, Vinay Chamola

Published 2026-10-21

Venue: arXiv

View source

Abstract

Sixth-generation (6G) communication systems are expected to support immersive, intent-driven, and latency-critical services through tight integration of multimodal intelligence, edge computing, and autonomous network control. In this setting, agentic AI systems can reason over heterogeneous inputs, use tools and network functions, coordinate across distributed entities, and adapt to dynamic environments. These capabilities make agentic multimodal intelligence promising for 6G applications such as semantic communications, digital twins, and zero-touch network management, but they also introduce security and privacy risks that extend beyond conventional AI and network security models. Vulnerabilities can propagate across multimodal data pipelines, memory, tools, communication interfaces, and inter-agent coordination loops. We survey multimodal intelligence and agentic AI for 6G cross-layered communication systems from the perspectives of privacy and security. We present a 6G-oriented system view spanning perception, memory, tool use, and multi-agent orchestration; analyze threat models and attack surfaces across sensing, cognition, action, memory, and communication layers; organize existing attacks into a structured taxonomy; and review mitigation strategies including prompt and memory defenses, inter-agent trust mechanisms, secure orchestration, and privacy-preserving learning. We conclude by outlining open research directions for trustworthy multimodal multi-agent 6G systems.

Summary

  • 6G communication systems integrate multimodal intelligence, edge computing, and autonomous network control to enable immersive, intent-driven, and latency-critical services.
  • Agentic AI systems in 6G can reason over heterogeneous inputs, utilize tools, coordinate among distributed agents, and adapt dynamically, enhancing applications like semantic communications, digital twins, and zero-touch network management.
  • The integration of multimodal inputs, persistent memory, tool utilization, and inter-agent coordination introduces security and privacy challenges beyond conventional AI and network security models.
  • The paper proposes a cross-layered security framework specific to 6G agentic AI systems, covering perception, memory, tool use, and multi-agent orchestration, along with threat models, attack taxonomy, and mitigation strategies.
  • Identified adversarial threats include prompt injections, memory poisoning, tool misuse, multi-agent trust exploitation, and cross-layer attack propagation affecting system integrity, privacy, and availability.

Concurrency aware artificial intelligence for real-time intrusion detection in software-defined networks

OpenAlex · Scientific Reports journal OpenAlex Agent-to-Agent Communication Orchestration Risk Benchmarks and Evaluation

R. Kanimozhi, V. Padmavathi, M. Latha

Published 2026-10-21

Venue: Scientific Reports

DOI: https://doi.org/10.1038/s41598-026-75362-x

View source

Abstract

Contemporary software systems are now being used in environments that are highly concurrent, data-intensive, and latency-sensitive. Software-Defined Networks (SDNs) applications like real-time intrusion detection need fast pattern recognition in large amounts of data streams through time. Although deep learning models have impressive detection capabilities, failure to perform well in real-world deployments is usually limited by poor concurrency management, inflexible scheduling, centralized learning pipelines, and fault tolerance. In this study, the authors suggest a concurrency-aware artificial intelligence (CA-AI) framework that directly incorporates actor-based concurrency control, workflow-based load-aware scheduling, deep long short-term memory (LSTM)-based temporal learning, agent-based parallel feature extraction, and feedback loops based on monitoring. The framework is evaluated for SDN-oriented intrusion detection workloads, where concurrency management is implemented at the system architecture level through actor-based execution, workflow scheduling, and asynchronous inference and tested on real network traffic data samples (NSL-KDD, CIC-IDS2017, and UNSW-NB15). Experimental results demonstrate that concurrency-aware system design leads to a significant improvement in the detection accuracy achieving up to 98.9% detection accuracy across multiple benchmark datasets, including NSL-KDD, CIC-IDS2017, and UNSW-NB15, throughput improved by 2.1 × compared with the centralized IDS baseline, while throughput increased by approximately 1.19 × when concurrency increased from 10,000 to 100,000 flows within the proposed CA-AI framework, average latency was reduced by approximately 57.5% compared with the centralized IDS baseline (146 ms to 62 ms), while maintaining high reliability under concurrent workloads. The proposed framework establishes concurrency as a fundamental architectural principle for scalable AI-driven pattern recognition systems.

Summary

  • The paper addresses challenges in real-time intrusion detection for software-defined networks (SDNs), focusing on the limitations posed by poor concurrency management, inflexible scheduling, centralized learning pipelines, and fault tolerance in existing de...
  • It proposes a concurrency-aware artificial intelligence (CA-AI) framework that integrates actor-based concurrency control, workflow-based load-aware scheduling, deep LSTM-based temporal learning, agent-based parallel feature extraction, and monitoring feedb...
  • The framework embeds concurrency management at the system architecture level through actor-based execution, workflow scheduling, and asynchronous inference to handle high concurrent network workloads.
  • Experimental evaluation is conducted on real-world network traffic datasets including NSL-KDD, CIC-IDS2017, and UNSW-NB15, tailored for SDN intrusion detection scenarios.
  • Results demonstrate a significant increase in detection accuracy, achieving up to 98.9% across multiple datasets, indicating robust intrusion identification performance.

Agency as a New Organizing Abstraction for Computer Science

Merged record merged scholarly record OpenAlex Governance and Policy Agent-to-Agent Communication

Ian T Foster

Published 2026-10-21

Venue: Communications of the ACM

DOI: https://doi.org/10.1145/3806060

View source

Abstract

Addressing the challenges of agentic AI will require targeted advances in systems, programming languages, theory, and human–computer interaction.

Summary

  • The paper identifies the emerging challenges posed by agentic AI in computer science.
  • It argues that existing frameworks are insufficient for addressing the complexities of multi-agent security and interaction.
  • The authors propose 'agency' as a new organizing abstraction to better structure research and development in this domain.
  • They emphasize the need for targeted advancements across multiple areas: systems architecture, programming languages, theoretical foundations, and human-computer interaction.
  • By centering on agency, the paper aims to unify research in AI-based problem solving, multi-agent systems, negotiation, and software engineering methodologies.

Credit Where Credit Is Due: Contrastive Attribution Topology Search for Multi-Agent Systems

Merged record merged scholarly record arXiv OpenAlex Trust and Identity Agent-to-Agent Communication Benchmarks and Evaluation

Fabian Tritthart, Tom Zehle

Published 2026-10-21

Venue: arXiv

DOI: https://doi.org/10.48550/arxiv.2610.29292

View source

Abstract

An LLM multi-agent system (MAS) is only as good as the agents it chooses to trust: its accuracy and cost hinge on its topology, meaning which agents are included and how they communicate. A single task score, however, does not reveal which agents help or hinder performance. We propose Contrastive Attribution Topology Search (CATS), which searches for compact teams within a fixed supergraph of specialized agents. An LLM attributer compares execution traces across candidate topologies and assigns credit to individual agents. CATS uses these credits to update supergraph edges while progressively pruning weak edges and agents, yielding a small team for deployment. With small open-weight models and matched candidate evaluations, CATS improves mean accuracy on BigCodeBench by 5.3 percentage points over score-only heuristic search while using 54\% fewer deployment tokens. On MBPP, CATS matches the strongest baselines with fewer tokens than the other searches. In a HotpotQA prompt-poisoning stress test, CATS excludes all adversarially prompted agents in all three runs, whereas random search retains some at comparable accuracy. Per-agent credit thus supports both team optimization and the pruning of potentially harmful agents.

Summary

  • The paper addresses the problem of optimizing multi-agent system (MAS) topologies, focusing on selecting a compact and effective team of specialized agents and their communication patterns to improve accuracy and reduce costs.
  • It proposes Contrastive Attribution Topology Search (CATS), a novel method that uses a large language model (LLM) as an attributer to assign signed credit to individual agents by comparing execution traces across different candidate topologies.
  • CATS iteratively prunes weak agents and edges in a fixed supergraph based on the attributed credits, resulting in a smaller deployed team that maintains or improves task performance.
  • Empirical evaluation on code generation benchmarks BigCodeBench and MBPP shows that CATS improves mean accuracy by 5.3 percentage points over score-only heuristic searches while using 54% fewer deployment tokens, and matches strong baselines with fewer toke...
  • In an adversarial security test with poisoned prompts on HotpotQA, CATS successfully excludes all adversarially prompted agents, unlike random search, demonstrating enhanced system robustness via credit-based pruning.
Load more articles