Multi-agent orchestration needs inter-agent threat detection

At a glance

What this is: This is an analysis of why multi-agent detection fails when security teams only instrument individual agents, with the key finding that attacks often propagate across delegation edges.

Why it matters: It matters because IAM, PAM, and AI security teams need to govern not just each agent's access, but the trust and privilege transferred between agents, shared memory, and orchestrator control points.

👉 Read ARMO's analysis of detecting threats in multi-agent orchestration systems

Context

Multi-agent orchestration creates a security problem that does not exist in single-agent systems: trust can be transferred from one agent to another even when each agent appears normal on its own. In practice, the dangerous behaviour sits in the delegation path, the shared context layer, and the supervisor or orchestrator that routes work between agents.

For IAM and NHI programmes, this is the same governance issue seen in other distributed identity systems. A single workload or agent may be correctly authenticated, yet the chain of delegated action can still expand scope, widen privilege, or move sensitive data in ways a per-agent baseline will not capture.

Key questions

Q: What breaks when AI agent security tools only monitor behavior?

A: Behavior-only tools miss the moment when an agent becomes dangerous through valid credentials and excessive reach. By the time the action looks suspicious, the agent may already have acted inside a trusted application. The control gap is not visibility alone. It is the absence of runtime enforcement tied to entitlement scope and invoker authority.

Q: Why do multi-agent systems complicate identity and access governance?

A: Because authority is no longer static inside one workload. A task, context object, or delegated instruction can carry effective privilege from one agent to another, which means access decisions happen across a chain. Governance has to cover how trust is transferred, not just who or what is logged in.

Q: How do security teams detect unsafe shared memory in agent workflows?

A: By treating memory writes and reads as security-relevant events. Teams should baseline which agents can write to shared context, what fields usually change, and which downstream agents consume those fields. Any unexpected addition of scope, destination, or instruction should be reviewed as possible contamination.

Q: What should teams prioritise first in multi-agent monitoring?

A: Start with the orchestrator and the delegation graph. Those layers reveal which agent routed work to which other agent, what context moved with the task, and where the workflow left its normal path. Once that is visible, per-agent behavioural detection becomes much more useful.

Technical breakdown

Delegation edges as the real security boundary

A delegation edge is the handoff point where one agent passes work to another. In multi-agent systems, that edge can carry scope, instructions, and context that never appear anomalous inside either endpoint. The key architectural issue is that the compromise propagates through the relationship, not through the individual agent. LangChain, CrewAI, AutoGPT, and AutoGen all express this differently, but the security pattern is the same: the edge becomes the unit of control, and the edge is where a malicious instruction can cross trust boundaries without triggering endpoint-only detection.

Practical implication: baseline and alert on agent-to-agent handoffs, not just agent runtime behaviour.

Shared context and memory can replay hidden instructions

Shared memory, scratchpads, vector stores, and session objects create a second attack surface because one agent can write content that another agent later reads as if it were trustworthy context. This is not simple data exposure. It is contextual contamination, where a poisoned summary or retrieved item influences downstream decisions without an explicit malicious action at the receiving agent. In orchestrated systems, the memory layer is often treated as plumbing, but operationally it acts like a high-trust communication channel that can silently carry prompt injection, scope expansion, or data exfiltration cues.

Practical implication: instrument writes, reads, and mutations in shared agent memory as security events.

The orchestrator is a control plane, not just workflow glue

The supervisor or orchestrator is the routing brain of the system. It decides which agent speaks next, which task is delegated, and what state is passed forward. That makes it a single trust boundary with outsized blast radius. If the orchestrator is compromised, the attacker does not need to defeat each agent separately. They only need to alter routing, speaker selection, or task assignment so that normal agents execute abnormal chains. This is why multi-agent detection has to treat orchestration telemetry as first-class security data, not product logs for debugging.

Practical implication: include orchestrator telemetry in security monitoring and correlate it with downstream access and data movement.

Threat narrative

Attacker objective: The attacker wants to convert a normal multi-agent workflow into a trusted data extraction and forwarding path without tripping per-agent detection.

1. Entry occurs when a user-supplied ticket or prompt contains an indirect injection that survives summarisation and enters the agent workflow.
2. Escalation happens when the injected instruction expands scope at the delegation edge and is carried into a higher-privilege downstream agent.
3. Impact follows when authorised tools are used in a coordinated chain to read, summarise, and transmit data outside the intended task boundary.

NHI Mgmt Group analysis

Per-agent detection is structurally insufficient for orchestrated AI systems. The article shows that adding more sensors to each agent does not create visibility across the chain connecting them. That is a governance failure, not a telemetry gap. Security teams need a control model that treats delegation paths as the security object, because agent boundary monitoring alone cannot represent how trust actually moves.

Delegation-edge visibility is the named control gap this category now exposes. The article makes clear that the compromised unit is the handoff, not the agent. That means the enterprise control question shifts from whether an agent behaved normally to whether the edge carried a payload, scope, or context outside its baseline. Practitioners should interpret this as a new class of inter-agent identity and authorisation problem.

Shared context creates a hidden authorisation channel between agents. Vector stores and scratchpads are often treated as convenience layers, but they function as high-trust inputs to later decisions. If one agent writes tainted context that another agent reads, the downstream action may still look authorised even though the decision path was contaminated. For AI governance teams, this is the point where data handling and delegation governance converge.

The orchestrator is becoming the de facto policy engine for agentic systems. Once routing, speaker selection, and task assignment determine who can do what next, the supervisor node becomes a privileged control point. That pushes multi-agent security closer to PAM and least-privilege thinking, but applied to agent chains rather than human admins. The practical conclusion is that orchestration telemetry should be governed like privileged access.

This problem sits at the intersection of NHI governance and agentic AI security. Agents are not merely tools that use tools. They are software actors that can inherit, transform, and pass on access intent across runtime boundaries. That makes the NHI question broader than secret storage. The relevant question is whether the organisation can govern identity, privilege, and context as they move between agents in motion.

What this signals

Delegation-edge telemetry is becoming the practical control point for agentic systems. As workflows move from single agents to supervised chains, security teams will need to model the edge as a governed identity transition, not a debug event. That aligns naturally with 52 NHI Breaches Analysis and the broader problem of access propagation across machine actors.

Multi-agent security will increasingly look like NHI governance applied to runtime coordination. The question is no longer whether an agent has credentials, but whether the system can explain why one agent was allowed to hand context or authority to another. That is the kind of boundary that also shows up in Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.

Named concept: delegation-edge blindness. This is the failure mode where every agent is monitored, yet the security team cannot see the trust transfer between agents. If organisations continue to rely on endpoint-only baselines, they will keep missing coordinated abuse that looks normal at each individual hop.

For practitioners

• Instrument delegation-edge baselines Capture which agent delegated to which, what fields changed in the payload, and how often each edge fires. Treat edge-level deviation as a security signal distinct from per-agent behaviour.
• Monitor shared context mutations Log writes and reads to scratchpads, vector stores, and session objects, then alert on context changes that expand scope, add destinations, or alter task intent.
• Correlate orchestrator telemetry with downstream access Join speaker selection, task routing, and workflow state transitions to database access, email dispatch, and tool invocations so the SOC can reconstruct a full inter-agent chain.
• Apply least-privilege thinking to agent chains Review which agent can delegate to which other agent, which contexts are shared, and whether a downstream agent receives more authority than the upstream agent should be able to pass on.
• Use runtime detection beyond endpoint baselines Extend existing behavioural analytics with application-layer framework telemetry from LangChain, CrewAI, AutoGPT, and AutoGen so the detector can see the relationship between agents, not just each workload.

Key takeaways

• Multi-agent attacks can remain invisible when security teams only baseline individual agents.
• The key control gap is delegation-edge visibility, because that is where scope and context move between agents.
• Practitioners should treat orchestrator telemetry, shared memory, and edge baselines as core security controls for agentic systems.

Key terms

• Delegation Edge: The point at which one agent hands work, context, or authority to another agent. In security terms, it is a distinct trust boundary because the payload can change meaning as it crosses into a different execution context. Baselines must measure the edge, not just the endpoints.
• Shared Context Layer: A shared context layer is the common record or state object that multiple agents use to coordinate work. It keeps reasoning, handoffs, and decisions visible so operators can audit actions, intervene safely, and avoid hidden state scattered across private memory or separate channels.
• Orchestrator: The control plane that routes messages, stores workflow state, and manages tool access across multiple AI agents. Because it concentrates delegation and logging in one place, it becomes the highest-value identity surface in the system and needs privileged-service treatment, not ordinary application handling.
• Edge Device Baseline: The approved configuration state for a device that operates outside a traditional datacentre or office endpoint model. In Linux fleets, the baseline must account for constrained resources, intermittent connectivity, and the operational role of the device, or security controls quickly diverge from reality.

What's in the full article

ARMO's full blog covers the operational detail this post intentionally leaves for the source:

• Framework-specific detection logic for LangChain, CrewAI, AutoGPT, and AutoGen deployments
• Examples of edge-level telemetry fields to baseline for delegation, routing, and context mutation
• Concrete runtime detection patterns for shared memory and orchestrator monitoring
• The full attack walkthrough that maps each stage to the telemetry signals the SOC should collect

👉 ARMO's full post covers the delegation chain, detection surfaces, and framework-specific telemetry patterns

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and machine identity security. It helps practitioners connect identity controls to agentic and workload-driven security programmes.