A multi-agent LLM system is an application where several AI agents share work to complete a task. Each agent handles a narrower function, such as planning, retrieval, tool use, or evaluation. This design improves flexibility and scale, but it also introduces coordination, auditability, and control challenges.
Expanded Definition
A multi-agent LLM system is not just a chatbot with a few prompts chained together. It is a coordinated application in which separate AI agents are given distinct responsibilities, such as planning, retrieval, code execution, verification, or escalation handling, and then asked to collaborate toward a shared outcome. In NHI security terms, each agent may possess its own credentials, tool permissions, memory scope, and data access path, which creates a broader identity and control surface than a single-agent workflow.
Definitions vary across vendors, especially around whether an orchestrator counts as an agent or merely a controller, but the security question is consistent: who can decide, who can act, and what can each agent reach? That framing aligns with guidance in the OWASP Agentic AI Top 10 and the CSA MAESTRO agentic AI threat modelling framework, both of which treat delegated autonomy as a security design problem rather than a pure application feature. The most common misapplication is treating all agents as if they share one trust boundary, which occurs when teams give multiple agents overlapping secrets and tool scopes without isolating permissions.
Examples and Use Cases
Implementing multi-agent LLM systems rigorously often introduces coordination overhead, requiring organisations to weigh faster task completion against more complex audit, approval, and containment controls.
- A research workflow uses one agent to gather sources, another to summarise findings, and a third to verify citations before output is released.
- An operations assistant routes an issue to a planning agent, then to a tool-using remediation agent, with a separate review agent checking whether the action is safe.
- A customer support stack lets one agent classify tickets while another drafts responses, but only a constrained agent may access account data or trigger refunds.
- An engineering pipeline uses one agent for code generation and another for static review, with no shared long-lived secret between them.
- NHIMG’s AI LLM hijack breach coverage shows how quickly compromised identity material can turn an AI workflow into an attacker-controlled path, a pattern reinforced by the Anthropic report on AI-orchestrated cyber espionage.
These examples matter because multi-agent designs often look modular on paper but become tightly coupled in production. The architectural question is not simply what each agent can do, but how failures, prompts, and credentials move between them.
Why It Matters in NHI Security
Multi-agent LLM systems expand the number of identities, permissions, and execution paths that must be governed. That increase matters because compromise rarely stays local: one over-permissioned retrieval agent can expose secrets, one tool agent can trigger destructive actions, and one evaluation agent can be manipulated into endorsing unsafe output. In NHIMG research, AI Agents: The New Attack Surface report found that 80% of organisations report agents have already acted beyond intended scope, while only 52% can track and audit the data those agents access. That gap turns coordination logic into a compliance and incident-response liability.
The right governance model must therefore combine least privilege, explicit delegation, tool isolation, and auditable handoffs, consistent with the NIST AI Risk Management Framework and MITRE ATLAS adversarial AI threat matrix. When agents share secrets or inherit permissions informally, the result is often a hidden privilege chain that no one intended to create. Organisations typically encounter the real impact only after an agent leaks data, executes an unauthorised tool action, or fails an audit, at which point multi-agent control becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agent autonomy and tool delegation are core risks in multi-agent LLM systems. |
| CSA MAESTRO | TM-2 | MAESTRO models agent workflows, trust boundaries, and orchestration threats. |
| NIST AI RMF | AI RMF covers governance, accountability, and operational risk for autonomous systems. | |
| NIST CSF 2.0 | PR.AA-01 | Identity and access governance underpin safe control of agent permissions. |
| NIST Zero Trust (SP 800-207) | Zero trust requires explicit verification for each agent action and resource request. |
Treat each agent as a governed identity with tightly scoped access and reviewable rights.
Related resources from NHI Mgmt Group
- Who is accountable when a multi-agent system causes damage?
- How should security teams trace decisions across multi-agent LLM systems when each handoff can lose context or policy state?
- How should security teams implement LLM tracing in multi-agent environments?
- What breaks when multi-agent LLM systems are not continuously observed?
