Threat T13

Rogue Agents in Multi-Agent Systems

Compromised AI agent activity outside monitoring limits or orchestration in multi-agent systems.

9/10 risk (Critical)
6 attack vectors
9 mitigating controls
11 framework refs

Overview

Impact level: High
Risk score: 9/10 (Critical)
CIA impact: Confidentiality, Integrity, Availability
Affected components: Agent Orchestration (KC2.1-KC2.5); External Environment Interface (KC6.1-KC6.3)
Tags: rogue, compromise, orchestration, multi-agent, monitoring
Source: OWASP Agentic AI T&M v1.1 (2025-12)

Attack vectors

How attackers carry out rogue agents in multi-agent systems against an agentic system.

Attack vector	Severity	Example
Agent Compromise	High	Malicious code injection into agent runtime
Orchestration Bypass	High	Agent operating outside management framework
Unauthorized Agent Deployment	High	Deploying malicious agents disguised as legitimate ones
Agent Hijacking	Medium	Taking control of legitimate agent through vulnerabilities
Swarm Infiltration	High	Introducing malicious agents into multi-agent systems
Command and Control	Medium	External control of compromised agents

Affected components

KC2 Orchestration (Control Flow)

KC6 Operational Environment (Agencies)

Mitigating controls

Controls from the catalog that reduce the likelihood or impact of T13.

M3 Secure Inter-Agent Communication
Implement cryptographically secure communication channels between agents with authentication, integrity verification, replay protection, and support for decentralized identity to prevent spoofing, poisoning attacks, and rogue agent infiltration.
M6 Comprehensive Security Monitoring & Auditing
Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.
M7 Zero Trust & Least Privilege Access
Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.
M10 Defense-in-Depth Architecture & Trust Boundaries
Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.
M12 Secure Model Training & Validation
Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M15 Agent Identity & Authentication Framework
Implement comprehensive agent identity management with decentralized identifiers, verifiable credentials, and strong authentication to prevent identity spoofing, enable secure agent discovery, and support agent reputation systems.
M17 Supply Chain Security & Provenance
Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.
M18 Incident Response & Recovery Framework
Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.

Framework mappings

OWASP Top 10 for Agentic Applications

Cisco AI Security Taxonomy

OWASP AIVSS core risks

AIVSS #3 Agent Access Control Violation AIVSS 9.7 (Critical)
AIVSS #4 Agent Supply Chain and Dependency Risk AIVSS 9.7 (Critical)
AIVSS #9 Agent Untraceability AIVSS 8.3 (High)
AIVSS #1 Agent Orchestration and Multi-Agent Exploitation AIVSS 10.0 (Critical)
AIVSS #2 Agentic AI Tool Misuse AIVSS 9.9 (Critical)
AIVSS #10 Agent Goal and Instruction Manipulation AIVSS 7.1 (High)

OWASP AISVS

Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection.

Requirements: C9.4.1, C9.4.2, C9.5.5, C9.5.7, C10.3.1, C10.3.5, C10.4.6, C5.1.2, C12.1.1, C12.1.2, C12.1.3, C12.1.4, C12.2.1, C12.2.2, C12.4.2, C12.4.3, C12.5.3, C5.1.1, C5.2.1, C5.2.2, C5.2.5, C5.2.6, C9.5.1, C9.5.2, C9.5.3, C9.5.6, C9.3.5, C9.3.6, C5.3.1, C4.1.1, C10.1.3, C1.3.1, C1.3.5, C3.2.1, C3.2.2, C3.5.1, C3.5.2, C11.1.1, C11.1.2, C11.1.3, C11.2.4, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C6.1.4, C9.4.3, C10.2.1, C10.2.2, C10.2.7, C6.1.1, C6.1.2, C6.1.3, C6.2.1, C6.2.2, C6.2.3, C3.1.2, C3.1.3, C1.1.2, C9.6.1, C9.6.3, C9.1.3, C3.3.2, C8.3.2.

Attack walkthroughs

Amazon Q Supply Chain Compromise: A poisoned prompt in the Q for VS Code repo ships to thousands before detection, showing how upstream agent-logic tampering cascades via extensions.
Malicious MCP Server Impersonating Postmark: First in-the-wild malicious MCP server on npm impersonated postmark-mcp and secretly BCC'd emails to the attacker.
Impersonated Observer Agent: An attacker injects a fake review agent into a multi-agent workflow.
T13 (Rogue Agents) in Collaborative Agent Swarm: A primary danger is a malicious agent joining the swarm.

References

Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11