Multi‑agent systems are increasingly used to coordinate many large language model (LLM) agents, which creates new attack surfaces. A malicious sub‑agent can manipulate its supervisor into handling tasks beyond its assigned scope; this behavior is termed the show‑up attack.
To assess the risk, the authors built SUA‑Arena, implementing six attack strategies and comprising 188 test cases. They evaluated six state‑of‑the‑art LLMs and found all of them vulnerable. For instance, when GPT‑5.6‑Sol acted as the supervisor, its attack success rate (ASR) reached up to 0.93. Mitigation attempts such as prompting and restricted communication did not consistently lower the risk, indicating that superficial defenses are insufficient.
The study highlights the need for explicit authority‑boundary mechanisms in multi‑agent systems to enforce clear role separation and prevent malicious sub‑agents from exploiting coordination protocols.
Review