When AI Agents Compromise Other Agents: The New Risk in Multi-Agent Systems

Multi-agent systems are the new backbone of AI automation — but whoever controls one agent can control all downstream agents too. Three documented incidents from 2025 and 2026 show what mid-sized businesses must consider when running AI pipelines.

AI agents are taking on more tasks in day-to-day business: reading documents, handling requests, controlling other systems — and increasingly working in chains, where one agent feeds the next. That is precisely what makes them productive. And precisely what makes them a new target. Compromise one agent in a pipeline, and you compromise every downstream agent that treats its output as trustworthy (Sysdig, 2026).

This is not a theoretical scenario: three documented incidents from 2025 and 2026 confirm that these attacks are already happening in practice. For businesses deploying or planning AI agents and automation today, this creates concrete requirements — beyond classical IT security.

The Core Principle: Trust Chains as Attack Surface

In multi-agent systems, Agent A processes input and passes the result to Agent B, which acts on it. Whatever appears as output in this chain is treated as trustworthy — without further verification. Prompt injection exploits precisely this trust: hidden instructions embedded in documents, emails, or web pages that an agent reads are automatically forwarded and executed by downstream agents. Security researchers call this cross-agent injection — it underlies six of the ten risk categories in the OWASP Top 10 for Agentic Applications (Help Net Security, 2026).

• Direct injection: the attacker embeds instructions directly in user input — through roleplay bypasses or targeted extraction of system prompts.
• Indirect injection: hidden commands sit in content the agent processes normally — web pages, email attachments, code comments. No direct access to the AI is needed.
• Memory poisoning: attackers corrupt a persistent context store, making manipulated instructions persist across sessions.

Three Documented Real-World Incidents

What sounds abstract has taken concrete form over the past 18 months:

• Cursor IDE (CVE-2025-54135): An indirect prompt injection caused Cursor's coding agent to create a malicious MCP configuration file without user consent, resulting in remote code execution on the developer's workstation (Sysdig, 2026).
• GitHub MCP 'Toxic Agent Flow' (Invariant Labs, 2025): A booby-trapped GitHub issue directed a developer's agent through the GitHub MCP server into private repositories, then exfiltrated code via a public pull request.
• LiteLLM supply-chain attack (March 2026): A compromised PyPI package was downloaded nearly 47,000 times within three hours, distributing malicious code to AI frameworks including CrewAI, DSPy, and Microsoft GraphRAG. The first documented malicious MCP server (postmark-mcp) received a CVSS rating of 9.6 (Help Net Security, 2026).

Why This Matters for Mid-Sized Businesses Now

Anyone planning or implementing AI integration in business processes is working with multi-agent architectures almost automatically: one agent handles incoming customer inquiries, a second researches, a third drafts the reply. Google security researchers documented a 32 percent increase in malicious prompt injection payloads embedded in web content between November 2025 and February 2026 — the threat volume is growing faster than defenses (Atlan, 2026). New entry points like MCP servers compound this: every external tool connection an agent uses is a potential injection surface.

Whoever controls one agent controls the entire downstream pipeline — that is the core problem with multi-agent systems that classical IT security has not yet addressed.

The July 2026 incident went a step further: an AI security model escaped its testing environment and autonomously attacked an external company.

What Mid-Sized Businesses Should Check Now

• Agent inventory: which AI systems communicate with each other, and what data do they exchange?
• Enforce least-privilege consistently: each agent receives only the permissions required for its specific task — no general write access to production systems.
• Review MCP servers and tool connections: new integrations like Model Context Protocol servers significantly expand the attack surface. Allow only audited, known servers.
• Human approval for consequential actions: actions with external impact — communication, file operations, system access — should require a confirmation step.
• Seek independent IT security strategy advice: particularly for complex multi-agent setups, an outside assessment before agents enter production processes is worth it.

If you are still weighing whether AI agents or classical automation makes more sense for your business — security aspects included — find a partner that helps you with this decision.