Threat T14
Human Attacks on Multi-Agent Systems
Exploits trust relationships between agents and workflows to manipulate human operators.
- 6/10 risk (High)
- 6 attack vectors
- 4 mitigating controls
- 5 framework refs
Overview
- Impact level: Medium
- Risk score: 6/10 (High)
- CIA impact: Integrity
- Affected components: Agent Orchestration (KC2.1-KC2.5)
- Tags: human, trust, social-engineering, manipulation, workflow
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out human attacks on multi-agent systems against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Trust Exploitation | Medium | Using agent authority to manipulate human decisions |
| Social Engineering via Agents | High | Agents used as vectors for social engineering attacks |
| Authority Impersonation | Medium | Agents claiming false authority to influence humans |
| Delegation Abuse | Medium | Exploiting human-agent delegation relationships |
| Workflow Manipulation | Medium | Altering workflows to create human vulnerabilities |
| Information Asymmetry | Medium | Leveraging agent access to information for manipulation |
Affected components
KC2 Orchestration (Control Flow)
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T14.
M6 Comprehensive Security Monitoring & Auditing
Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.
M8 Adaptive Human-in-the-Loop Controls
Implement intelligent human oversight with risk-based approval workflows, clear decision interfaces, anti-fatigue mechanisms, and adaptive trust systems to prevent approval overwhelm, human attacks, and manipulation while maintaining effective oversight.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M16 Behavioral Monitoring & Ethics Framework
Implement comprehensive behavioral analysis, ethics enforcement, and bias detection to identify misaligned behaviors, prevent human manipulation, and ensure ethical agent operations while maintaining transparency and accountability.
Framework mappings
OWASP Top 10 for Agentic Applications
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #3 Agent Access Control Violation AIVSS 9.7 (Critical)
- AIVSS #9 Agent Untraceability AIVSS 8.3 (High)
- AIVSS #10 Agent Goal and Instruction Manipulation AIVSS 7.1 (High)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C6 Supply Chain Security for Models, C7 Model Behavior, Output Control & Safety Assurance, C9 Orchestration & Agentic Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C12.1.1, C12.1.2, C12.1.3, C12.1.4, C12.2.1, C12.2.2, C12.4.2, C12.4.3, C12.5.3, C9.4.2, C9.2.1, C9.2.2, C9.2.3, C9.2.4, C9.2.8, C9.2.10, C9.6.2, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C4.1.1, C6.1.4, C1.3.3, C7.3.1, C11.1.1, C11.1.5, C12.3.4.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11