From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems

Source: arXiv:2608.00202 · Published 2026-07-31 · By Yashaswi Malla, Sandra Siby

TL;DR

This paper addresses the evolving security landscape when Large Language Model (LLM)-based web agents transition from single-agent systems (SAS) to multi-agent systems (MAS). MAS improve task performance by decomposing roles among specialized sub-agents but introduce new structural attack surfaces absent in SAS. To systematically characterize these emerging vulnerabilities, the authors propose a detailed taxonomy of attack vectors specific to web-based MAS. They then develop WEBMASLAB, a testbed platform enabling controlled, reproducible security evaluations of web agents under identical environmental conditions while varying only the agent architecture (SAS vs MAS).

Using WEBMASLAB, the authors design and implement three representative multi-stage attacks, including a novel MAS-specific "Telephone Loop" attack exploiting cyclical cross-agent delegations to induce denial-of-service. Their evaluation across four state-of-the-art LLMs (Claude Sonnet 4.5 & 4.6, GPT-5.2 & GPT-5.4) reveals that MAS are substantially more vulnerable than SAS under the same settings, with attack success rates averaging 80% at baseline for three models. Only Claude Sonnet 4.6 shows significant resistance (92% detection). Prompt hardening defenses produced uneven results, dramatically reducing attack rates only for some models. The study highlights that decomposing monolithic web agents into specialized collaborating subagents substantially expands and changes the attack surface, necessitating novel security paradigms tailored to MAS architectures.

Key findings

• MAS exhibit an average 80% attack success rate (ASR) across three of four frontier LLM models at baseline in the novel Telephone Loop attack, which is inert against SAS.
• Claude Sonnet 4.6 uniquely resists the Telephone Loop attack with a 92% detection rate; others have 0% detection at baseline and only up to 33% with prompt hardening.
• Prompt hardening collapses one model's ASR from 100% to 8%, but offers only modest reduction for other models, indicating poor generalization of obvious defenses.
• The taxonomy identifies seven MAS-specific threat vectors and categorizes thirteen concrete attack patterns into five high-level classes relevant to web MAS.
• WEBMASLAB isolates architecture as the sole variable by fixing user task, tool surface, and browser substrate, enabling direct SAS vs MAS comparison under identical conditions.
• Multi-agent role specialization introduces systemic risks such as delegation cycles, inter-agent trust asymmetry, distributed payload splitting, and partial context that amplify vulnerabilities versus SAS.
• Three multi-stage attacks—Vault Mirage (credential phishing), Header Heist (session token exfiltration), and Telephone Loop (delegation cycles)—exercise seven of thirteen taxonomy attack patterns.

Threat model

The adversary is a remote, web-based attacker controlling only the content of publicly reachable web pages visited normally by the agent. They do not have any privileged access to the user's host system, browser profile, network proxies, or agent code base. They cannot tamper with the underlying LLM models, prompts, environment variables, or tools. The adversary can host malicious pages, inject deceptive content and prompts, and solicit information via web interfaces in order to influence or exfiltrate data from the multi-agent system through its normal browsing activity. The threat model excludes insider agent compromise or attacker control over agent internals.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is a remote web-only attacker controlling the content available on web pages visited by the agent. They have no privileged access to the user's host, browser settings, tools, or agent code. The attacker cannot modify agent code, system prompts, or environment variables. The adversary can host malicious web pages, inject deceptive context and prompts, or solicit seemingly benign info to trigger attacks via compromised web content.

2. Data and Environment: Experiments run inside Zoo, a closed-world simulated multi-service web environment (.zoo TLD) featuring a decentralized forum (postmill) and webmail (snappymail) as representative web platforms. Additional attacker-controlled servers provide staged malicious sites. The setup fixes the user task, backbone LLM model (4 different ones tested), browser substrate (Chrome with persistent user profile), and toolset, isolating architectural differences (SAS vs MAS) as the independent variable.

3. Architecture: Single Agent System (SAS) is a monolithic agent with full tool access. Multi Agent System (MAS) decomposes the task into multiple specialized subagents organized in an Executive layer (Dispatcher and Credential Manager) and a Specialist layer (Shopper, Social Media, Clerk, Researcher, File Handler). MAS agents communicate in a mesh with delegation capabilities. Both SAS and MAS use the same CrewAI framework and share the same LLM backend and per-agent budget.

4. Training and Prompting: Agents receive a configurable backstory context to guide behavior, with three evaluation conditions tested: baseline, prompt-hardened (augmented with hardened defensive instructions), and reasoning-enabled (enabling explicit logical chains). The exact prompting and reasoning details are controlled but not fully disclosed. No further training or fine-tuning is described.

5. Evaluation Protocol: The authors implement three multi-stage proof-of-concept (PoC) attacks—Vault Mirage (credential phishing), Header Heist (session token exfiltration), and Telephone Loop (MAS-specific delegation cycle). Multiple runs per model and condition are executed. Successful attack outcomes are logged based on exfiltration or induced denial-of-service within fixed time windows. Evaluation metrics include Attack Success Rate (ASR), detection rates, and exposure rates. SAS and MAS performance are compared directly under identical task and environment conditions, isolating the impact of agent architecture.

6. Reproducibility: The WEBMASLAB testbed is implemented using open-source components BrowserGym and CrewAI, with the Zoo environment. The authors provide detailed architectural descriptions and attack scripts but code and model weights are not publicly released. The underlying LLMs include proprietary systems (Claude Sonnet versions, GPT-5 variants).

Example Walkthrough (Vault Mirage Attack): The user task involves checking a product link embedded in a malicious email hosted on ebuy.shop controlled by attacker. The MAS agents sequentially process the email content (Dispatcher → Social Media Specialist → E-Commerce Specialist), who is tricked by a fake Amazon login banner. The E-Commerce specialist requests credential filling from Credential Manager who injects stored credentials without verifying the domain legitimacy. Credentials are exfiltrated via a POST request to the attacker server. The chained role delegation and trust in partial context lead to vulnerability, demonstrating inter-agent trust asymmetry and telephone-game drift.

Technical innovations

• A novel, MAS-specific "Telephone Loop" attack that exploits cyclical cross-agent task delegation to cause denial-of-service, inert against SAS.
• A comprehensive taxonomy categorizing web-based MAS attack vectors into seven threat vectors and five high-level classes with thirteen concrete attack patterns, unifying prior SAS and MAS security literature in a web context.
• Development of WEBMASLAB, a testbed that holds web environment, toolset, and tasks constant to isolate architectural impact by comparing SAS and MAS configurations under externally controlled web adversaries.
• Empirical comparison demonstrating that multi-agent decomposition fundamentally alters attack surfaces and defense responses compared to monolithic SAS, with prompt-hardening defenses showing inconsistent efficacy across models.

Datasets

• Zoo simulated web environment — moderate scale — open-source simulated multi-service environment on .zoo domain
• Attacker-controlled local web servers — custom setup — independent Python HTTP servers for malicious scenarios

Baselines vs proposed

• SAS baseline: Telephone Loop attack ASR = ~0% across models vs MAS: Telephone Loop ASR = ~80% average across three models
• MAS with prompt-hardening: Telephone Loop attack detection improved from 0% to 33% on one model, negligible on others
• MAS prompt-hardening effect varies by model, collapsing ASR from 100% to 8% in one model but only modest reductions in others
• Claude Sonnet 4.6: attack detection rate = 92%, outperforming other models with near-zero detection at baseline

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2608.00202.

Fig 5: compares the MAS and SAS configurations.

Fig 6: Vault Mirage Attack: ASR by experimental condition for MAS

Fig 7: Header Heist Attack: Per-run outcome composition by model

Fig 8: Header Heist Attack: Attack success rate by condition and model

Fig 9: Header Heist Attack: Detection (bottom) and exposure (top) rates.

Fig 10: Telephone Loop Attack: Outcome composition by model and

Fig 11: Base Backstory Prompt for File Handler Specialist

Fig 12: Hardened Backstory Prompt for Credential Manager

Limitations

• All experiments conducted within a simulated 'closed-world' web environment (Zoo), which may not capture full real-world web heterogeneity or evolving adversarial behaviors.
• LLM backends used include proprietary models; lack of open weights/code limits ease of reproducibility and independent verification.
• Prompt hardening implementation details and tuning are not exhaustively described, hindering transfer of defense methods.
• No evaluation against fully adaptive adversaries who may learn agent behaviors online or dynamically modify web content during agent runs.
• Focus is on cross-agent architectural vulnerabilities under a fixed static adversary model; other threat models such as insider compromised agents or privileged attacker not explored.
• Results depend on particular CrewAI framework and browser tool integration; generalization to other LLM agent frameworks or toolsets is undemonstrated.

Open questions / follow-ons

• How can defenses be designed specifically for MAS architectural risks such as delegation loops, inter-agent trust asymmetries, and partial context sharing?
• What are the impacts of more sophisticated, adaptive adversaries who dynamically modulate attack payloads based on agent state or previous detections on MAS security?
• Can MAS architectures be redesigned to achieve the benefits of role specialization while minimizing expanded attack surfaces?
• How well do current findings generalize to other multi-agent coordination frameworks, varying numbers of agents, or multimodal agents beyond pure LLM text backends?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this study highlights emerging architectural vulnerabilities when decomposing single-agent LLM systems into multi-agent swarms. While MAS provide improved performance via role specialization, they introduce novel attack surfaces including delegation loops and cross-agent trust exploitation that can cause denial-of-service or credential exfiltration. Defenses effective against isolated SAS prompt injection attacks do not straightforwardly transfer. Implementers of CAPTCHA and bot detection on multi-agent web platforms should consider these systemic risks, carefully audit inter-agent communication protocols, and develop MAS-aware threat models. The presented taxonomy and WEBMASLAB testbed offer a foundation for analyzing multi-agent specific attack vectors, which can inform the design of hardened multi-agent bot defenses and detection mechanisms sensitive to cyclical delegation or distributed payload splitting. The findings caution against naïve role decomposition without rigorous security evaluation.

Cite

@article{arxiv2608_00202,
  title={ From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems },
  author={ Yashaswi Malla and Sandra Siby },
  journal={arXiv preprint arXiv:2608.00202},
  year={ 2026 },
  url={https://arxiv.org/abs/2608.00202}
}

Read the full paper

• arXiv:2608.00202 (abstract)
• arXiv:2608.00202 (PDF)