From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems

2026-07-31

AI Summary

This work addresses the emerging security challenges in large language model (LLM)-driven multi-agent web systems, which, despite enhancing task performance, introduce novel structural attack surfaces absent in single-agent systems and remain poorly understood. The paper formally defines this attack surface for the first time and proposes a taxonomy of attack vectors specific to multi-agent web environments. To empirically evaluate security differences, the authors develop WebMASLab—a testbed that compares single- and multi-agent architectures under identical tasks, tools, and browser conditions. Key contributions include the identification of the “telephone loop” attack, achieving an average success rate of 80% across three state-of-the-art models, and the revelation of security risks stemming from role specialization. Through adversarial simulation and evaluations of defenses such as prompt hardening and reasoning augmentation, the study finds that only Claude Sonnet 4.6 attains a 92% detection rate, while prompt hardening shows limited generalizability, underscoring the unique security challenges inherent to multi-agent architectures.

Abstract

Large Language Model (LLM)-based web agents are increasingly evolving from single-agent systems (SAS) to multi-agent systems (MAS). While MAS can lead to improved task performance by decomposing complex tasks across specialized sub-agents, such role decomposition introduces new structural attack surfaces that are absent in SAS. This expanded attack surface remains poorly understood and inadequately categorized. To address this, we propose a taxonomy to categorize attack vectors specific to web-based MAS, accounting for vulnerabilities introduced or amplified by the involvement of multiple agents. We further present a test-bed WebMASLab to analyze web agent security against a fully external, web-only adversary. To isolate the effect of architecture, we keep the user task, tool surface, and browser substrate fixed, and compare single- and multi-agent setups. We evaluate three adversarial scenarios, across three conditions (baseline, prompt-hardened, and reasoning-enabled), including a novel MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops. The attack is inert against SAS but compromises MAS when powered by three of the four frontier models evaluated (Claude Sonnet 4.5, GPT-5.2, GPT-5.4), averaging 80% across them at baseline. Only the fourth model, Claude Sonnet 4.6, resists the attack with a 92% detection rate. For the rest, the detection is 0% at baseline, reaching 33% with prompt-hardening for one model. We also show that obvious defenses do not generalize; prompt-hardening collapses one model's ASR from 100% to 8% while providing only modest reduction to the others. Our findings demonstrate that the transition from single- to multi-agent web systems changes the security landscape. Role specialization may not only lead to performance optimization but also introduce new architectural risks that require further study and defenses.

Problem

• attack surface
• multi-agent systems
• web agents
• security taxonomy
• LLM-based systems

Innovation

• multi-agent systems
• attack surface
• LLM security
• Telephone Loop attack
• WebMASLab