AI Security Atlas › All entries › Multi-Agent & Memory Trust
No Isolation Between Agents
Agents trust each other's outputs, share credentials or memory, and keep running when upstream agents misbehave.
Open in the interactive atlas →Impact
There is no boundary where a fault can be stopped.
Why this severity
Impact High × Likelihood Medium = High
Impact high: faults spread unchecked. Likelihood medium: shown in worm research; common in prototypes.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Demonstration: Morris II Worm: RAG-Based Attack (MITRE ATLAS case study AML.CS0024, 2024)
Related
Exploited by
- Cascading Multi-Agent Failure Threat · High severity
Mitigated by
- Blast-Radius Isolation & Circuit Breakers Guardrail · Fixes high risks
Remediation
- Give each agent its own identity, credentials, and quotas.
- Validate and schema-check every inter-agent message.
- Define failure modes: halt, retry, or escalate.
How to verify
- Architecture review shows no shared long-lived credentials.
- Fault-injection tests confirm downstream agents reject malformed input.
Framework mapping
OWASP Top 10 for Agentic Applications 2026
- ASI08:2026 Cascading Failures
OWASP Top 10 for LLM Applications 2025
- LLM06:2025 Excessive Agency
NIST AI RMF 1.0
- MAP 4.2 Internal risk controls for AI components are identified and documented