PIP-013
Multi-agent trust abuse
One agent's output becomes another agent's input, and the receiving agent trusts it because it came from inside the system.
How it works
In a pipeline of agents, output from an upstream agent is passed downstream as context. Downstream agents typically apply less scrutiny to internal messages than to user input, so a single compromised agent can direct the behaviour of every agent after it.
Why it works
Trust boundaries inside multi-agent systems are usually implicit and undocumented. Provenance is lost the moment content is handed on, and each hop tends to increase apparent trustworthiness.
What it looks like
Content that reaches an early, broadly-exposed agent and is written so that it survives summarisation and arrives downstream as an apparent instruction.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Document the trust boundaries
Architectural
Establish which agent may instruct which, and where content originating outside the system enters the pipeline. Most such systems have never had this written down.
Carry provenance through the pipeline
Raises cost
Keep the origin of content attached to it, so a downstream agent can distinguish an upstream conclusion from text that entered from outside.
Grant privileges per agent, not per system
Architectural
Give each agent only what its own step requires, so compromising the exposed agent does not confer the pipeline's full capability.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- LLM06:2025 · OWASP LLM Top 10
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.