TL;DR: Attacks that move across delegation edges in LangChain, CrewAI, and AutoGPT workflows cannot be detected by per-agent sensors, because the compromise is visible in the handoff, shared context, and orchestrator layers rather than inside any single agent, according to ARMO. The real control problem is inter-agent visibility, where multi-agent detection must baseline edge behavior, context mutation, and routing patterns, not just individual workloads.
At a glance
What this is: ARMO argues that multi-agent orchestration creates attack paths that individual agent detectors cannot see because the compromise often lives in delegation, shared memory, and orchestration, not inside a single agent.
Why it matters: IAM and AI security teams need edge-level and context-level visibility because multi-agent workflows can turn apparently healthy agents into a coordinated breach path without tripping per-agent controls.
Context
Multi-agent orchestration changes the security model because a workflow is no longer just one runtime making local decisions. The risk sits in the relationships between agents, especially where delegation, shared context, and orchestration allow instructions or data to cross boundaries.
In these systems, traditional per-workload monitoring can still show each agent behaving as expected while the chain connecting them is compromised. That makes the control question less about one model or one container and more about the trust edges between agents, which is where identity and authorisation concerns start to matter.
Key questions
Q: What breaks when per-agent detection is used for multi-agent orchestration?
A: Per-agent detection breaks because it assumes the suspicious behaviour will be visible inside one agent’s boundary. In multi-agent workflows, the compromise often appears only in the handoff, shared context, or routing decision, while each individual agent still behaves normally. Security teams need edge-level baselines to see the full attack path.
Q: Why does delegated access increase risk in agentic AI workflows?
A: Because an agent with broad or standing access can turn one task into many unintended actions across connected systems. The risk grows when permissions are not tightly tied to a specific workflow, because the agent can act faster than human review cycles and can cross boundaries that were never intended for that task.
Q: What are the signs that agent memory is drifting into a security problem?
A: Watch for memory entries that start to elevate a specific user, privilege repetitive instructions, or override original operating rules. A second signal is when direct malicious prompts fail but similar requests succeed after repeated benign-looking interactions. Those patterns suggest the system is learning an authority model from interaction history instead of preserving one.
Q: How should security teams govern multi-hop agent delegation chains?
A: Security teams should govern multi-hop delegation as a chain of explicit authorisations, not as a series of disconnected API calls. Every hop should preserve the original delegator, contract scope, and bind the token to the runtime that uses it. The strongest control is policy at token exchange, then revalidation at the resource boundary.
Technical breakdown
Delegation edges as the real attack surface
A delegation edge is the point where one agent hands work to another, such as a task transition in CrewAI, a node change in LangGraph, or a message turn in AutoGen. Security tools that baseline only the agent miss the fact that the edge carries scope, context, and authority forward. If an injected instruction changes what is handed off, the receiving agent can still look normal while acting on compromised inputs. The edge therefore becomes the unit of trust, not just the agent process itself.
Practical implication: Instrument agent-to-agent handoffs and baseline the payload shape, scope, and frequency of each delegation path.
Shared context and memory can propagate compromise
Shared context layers, including scratchpads, vector stores, and conversation buffers, let one agent write information that another later reads. That is operationally useful, but it also means a poisoned write can survive across turns without passing through a visible handoff event. In multi-agent orchestration, this creates an input provenance problem: the system must know not only what a later agent read, but where that content originated and whether it was mutated in transit. Without provenance at the memory layer, attacks can hide inside apparently routine context reuse.
Practical implication: Track provenance and mutation history for shared memory objects, not just the final prompts sent to each agent.
The orchestrator is a control plane with its own trust boundary
The orchestrator or supervisor node routes tasks, selects speakers, and decides which agent acts next. That makes it a control plane, not a passive message bus. If the orchestrator is compromised, or if its routing logic is manipulated through malformed context, the entire workflow can inherit the abuse downstream. Multi-agent security therefore needs telemetry from the orchestrator itself, because its decisions reveal whether delegation patterns, routing depth, and branching logic are staying within expected bounds.
Practical implication: Treat the orchestrator as a monitored trust boundary and alert on routing, depth, or speaker-selection anomalies.
Threat narrative
Attacker objective: The attacker wants to turn a legitimate multi-agent workflow into a covert data-exfiltration path by abusing the trust between agents.
- Entry occurs when an indirect prompt injection is hidden inside a user-submitted log or ticket and reaches the first agent as normal-looking text.
- Credential access is not the primary issue here, but the compromise propagates when delegated context carries instructions into later agents that are trusted to act on it.
- Escalation happens when a downstream agent expands the request scope, reads more data than intended, or attaches an outbound destination to the task.
- Impact follows when the final agent performs an apparently authorised action, such as sending data to an allowlisted recipient or exposing records through a normal workflow.
Breaches seen in the wild
- CrewAI Uncrew GitHub token exposure: A CrewAI provisioning error exposed an admin GitHub token for all its private repositories; Noma reported it and CrewAI fixed it in hours.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Inter-agent visibility is now a separate security control class: multi-agent systems create failure modes that do not exist in single-agent workloads. Per-agent baselines still matter, but they cannot explain attacks that are carried by a delegation edge, a shared memory object, or a routing decision. The practical conclusion is that orchestration telemetry must be treated as security telemetry, not just observability data.
Delegation is the point where identity and authority collide: once one agent can pass context or scope to another, the security question becomes who is allowed to delegate what, to whom, and under which constraints. That is an identity governance problem as much as a detection problem, especially when the downstream agent has broader tool or data access than the upstream one. Practitioners need controls that validate delegated authority at the moment of transfer.
Shared context creates a hidden persistence layer: if memory, scratchpads, or conversation buffers can carry poisoned state across turns, then runtime security must move upstream of execution. The article shows why the old assumption that every agent boundary is independently trustworthy no longer holds. Teams should treat context mutation and provenance as first-class governance objects.
Orchestrator telemetry is the named concept that closes the gap: the key security pattern is not more agent alerts, but visibility into edge behaviour, context mutation, and routing variance. That concept gives security teams a practical way to define the control surface for multi-agent systems and to align detection with how orchestration actually works. The practitioner takeaway is to baseline the control plane as carefully as the workloads it coordinates.
Multi-agent detection must be built around trust edges, not workload counts: adding more agents increases coordination complexity faster than it increases detection coverage. The article’s core lesson is that the architecture of the attack follows the architecture of the workflow. Security teams should therefore govern handoffs, shared state, and routing rules as a single detection domain.
What this signals
Edge-level baselining is the missing control plane: multi-agent security cannot rely on single-agent anomaly detection because the dangerous behaviour often emerges only when one agent hands work to another. Security teams should expect orchestration logs, state transitions, and context mutation events to become as important as process telemetry.
The practical programme shift is to treat the orchestrator, shared memory, and delegation graph as one detection surface. That changes how teams inventory agent workflows, how they scope incident response, and how they decide whether a workflow is safe to run in production.
For practitioners
- Instrument delegation telemetry Capture every agent-to-agent handoff, including payload shape, scope fields, routing choice, and delegation depth, so deviations can be compared against normal edge behaviour.
- Baseline shared context mutations Record who wrote to shared memory, what changed, and which downstream agent consumed it, because poisoned context often survives longer than the original prompt.
- Monitor orchestrator routing variance Alert when speaker selection, recursion depth, or task routing departs from the normal workflow pattern, especially in hierarchical crews and message-driven agent groups.
- Correlate runtime alerts across the agent chain Join per-agent runtime signals with edge-level events so a normal-looking agent action can still be evaluated in the context of the preceding delegation path.
Key takeaways
- Multi-agent orchestration creates security gaps that per-agent monitoring cannot close because the compromise often lives in the handoff between agents.
- Shared context and orchestrator logic are not neutral plumbing, they are trust boundaries that can carry malicious instructions across a workflow.
- Security teams need edge baselines, provenance tracking, and routing telemetry if they want to detect coordinated agent abuse before it becomes data loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Delegation across agents creates privilege and authority transfer risks central to this article. |
| ASI07 — Insecure Inter-Agent Communication | The article’s core blind spot is the security of messages, handoffs, and shared context between agents. | |
| ASI08 — Cascading Failures | A compromise in one agent can cascade through the workflow via orchestration and shared memory. | |
| Recommendation — Baseline agent-to-agent authority transfers and alert when delegated scope exceeds the originating agent’s intent. Instrument inter-agent messages and verify that context, scope, and provenance remain intact across every handoff. Model agent workflows for cascading failure paths and contain propagation at the first compromised edge. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is about governing multi-agent control boundaries, telemetry, and accountability. |
| Recommendation — Assign clear governance ownership for delegation, routing, and shared-context security across the agent stack. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalies and Events | Inter-agent detection depends on monitoring orchestration anomalies that single-agent tools miss. |
| Recommendation — Extend monitoring to delegation edges, shared memory, and orchestrator events so anomalies are visible in context. | ||
| MITRE ATT&CK | TA0001;TA0006;TA0008;TA0010 — Initial Access; Credential Access; Lateral Movement; Exfiltration | The article maps a multi-stage abuse chain spanning injection, propagation, and data loss. |
| Recommendation — Map multi-agent abuse paths to ATT&CK tactics and prioritize detection where trust crosses agent boundaries. | ||
Key terms
- Delegation Edge: The point at which one agent hands work, context, or authority to another agent. In security terms, it is a distinct trust boundary because the payload can change meaning as it crosses into a different execution context. Baselines must measure the edge, not just the endpoints.
- Shared context: The minimum set of common data points that lets different tools and teams interpret a finding the same way. In practice, this includes ownership, criticality, environment, and status, which together turn isolated signals into decisions that can be acted on quickly.
- Orchestrator: The control plane that routes messages, stores workflow state, and manages tool access across multiple AI agents. Because it concentrates delegation and logging in one place, it becomes the highest-value identity surface in the system and needs privileged-service treatment, not ordinary application handling.
- Inter-Agent Visibility: Inter-agent visibility is the ability to observe and assess what happens between agents, not just inside each agent. It combines handoff telemetry, context provenance, and routing signals so security teams can detect coordinated abuse that single-agent tools will miss.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in the context of modern security programmes. It helps practitioners connect identity controls to the wider risks created by delegated access and shared trust.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org