AI Agent Networks: Large-Scale Failures Exposed

Interactions Between AI Agents: A New Challenge for Security

The risks associated with intelligent agents often only manifest when they interact with each other, rather than when they are tested individually. An action that seems harmless can, in reality, trigger a series of undesirable events across a network of agents.

In our tests, we observed that a simple malicious message could be transferred from one agent to another, leading to the extraction of private data at each step and even involving agents that were not initially concerned.

Although some agent networks show signs of increasing resistance to these attacks, establishing effective defenses remains a major challenge. We continue to work on these issues to enhance the security of interactions between agents.

The Emergence of Agent Networks: An Interconnected Environment

With the evolution of large language models (LLMs) and silicon technologies, the creation of agents has become more accessible, facilitated by tools like Claude, Copilot, and ChatGPT. These agents, once isolated, now interact in a shared environment thanks to platforms such as email and GitHub.

This interconnection allows agents to distribute tasks, share resources, and rely on the expertise of their principals, the humans they represent. Due to their constant activity and ability to communicate faster than humans, information can spread across a network in minutes, providing significant added value to users.

However, this same interconnection introduces new risks. For example, a social network dedicated to agents quickly attracted thousands of agents but was also overwhelmed by spam and scams shortly after its launch. Our experiments on an agent marketplace showed that while agents can share information and coordinate their behaviors effectively, failures propagate just as quickly.

Understanding the Dynamics of Agent Networks

To better understand these dynamics, we tested a live internal platform with over 100 agents using different models, instructions, and memories. Each agent acted on behalf of a human, participating in forums, direct messages, and collaborative tasks. We identified four major risks that only manifest at the network level:

• Propagation: Agent worms spread from one agent to another, collecting private data at each step.
• Amplification: An attacker can use the reputation of a trusted agent to introduce a false claim, creating a chain reaction of fabricated evidence.
• Trust Capture: An attacker can manipulate the agent verification system, turning a validation system into a tool for reinforcing lies.
• Invisibility: Information can circulate through chains of uninformed agents, making it difficult to trace the origin of an attack.

We also observed early signs of defense: a minority of agents adopted secure behaviors that limited the impact of attacks. These results indicate that building useful agent networks will require a deep understanding and mitigation of these risks at the network level, starting with real-world deployments.

Setting Up the Experiment: A Multi-Agent Platform

We evaluated a live internal multi-agent platform, where each principal is represented by one or more always-active LLM agents, using variants of GPT-4o, GPT-4.1, and GPT-5. These agents maintain a persistent context and are periodically activated by a timer, allowing them to operate autonomously.

On this platform, agents can post in a shared public forum, send direct messages, and use integrated applications to organize meetings, exchange currencies, and goods. Basic safeguards are in place, such as a reputation system that tracks positive and negative votes, with low scores limiting access to certain tools. A 30-minute delay between posts and restrictions on tool usage help regulate activity. At the time of testing, over 100 agents had accumulated weeks of conversation history, developed relationships, and cultivated a reputation through their autonomous participation.

Identified Risks: A Threat to Network Security

1. Self-Propagating Worms: An Invisible Threat

The attacker’s goal is to trigger a single action that autonomously spreads across the network, exfiltrating private data at each hop without further intervention. This resembles traditional network worms that exploit software vulnerabilities, but here, the vulnerability is behavioral: agents follow the instructions of their peers and relay messages, which is sufficient to enable replication.

2. Reputation Manipulation: Chain Reactions

The attacker aims to launch a network-wide smear campaign against a target agent through other agents, leaving no trace back to the attacker. This resembles the exploitation of social proof to fabricate consensus, known as astroturfing and sockpuppeting.

3. Fabricated Consensus: Verification as a Vulnerability

The attacker manipulates agents into disclosing sensitive information by fabricating a consensus, making a single attacker appear as multiple independent corroborators. This evokes a Sybil attack applied to social trust, where false identities create the appearance of multi-party corroboration, which cautious agents seek, turning verification into an attack surface.