ACIArena: Toward Unified Evaluation for Agent Cascading Injection

Hengyu An; Minxi Li; Jinghuai Zhang; Naen Xu; Chunyi Zhou; Changjiang Li; Xiaogang Xu; Tianyu Du

cs.AIApr 9, 2026

ACIArena: Toward Unified Evaluation for Agent Cascading Injection

Authors: Hengyu An, Minxi Li, Jinghuai Zhang, Naen Xu, Chunyi Zhou, Changjiang Li, Xiaogang Xu, Tianyu Du,

Organizations: Zhejiang University · State Key Laboratory of Internet Architecture, Tsinghua University · University of California, Los Angeles · Palo Alto Networks ·

Abstract

Collaboration and information sharing empower Multi-Agent Systems (MAS) but also introduce a critical security risk known as Agent Cascading Injection (ACI). In such attacks, a compromised agent exploits inter-agent trust to propagate malicious instructions, causing cascading failures across the system. However, existing studies consider only limited attack strategies and simplified MAS settings, limiting their generalizability and comprehensive evaluation. To bridge this gap, we introduce ACIArena, a unified framework for evaluating the robustness of MAS. ACIArena offers systematic evaluation suites spanning multiple attack surfaces (i.e., external inputs, agent profiles, inter-agent messages) and attack objectives (i.e., instruction hijacking, task disruption, information exfiltration). Specifically, ACIArena establishes a unified specification that jointly supports MAS construction and attack-defense modules. It covers six widely used MAS implementations and provides a benchmark of 1,356 test cases for systematically evaluating MAS robustness. Our benchmarking results show that evaluating MAS robustness solely through topology is insufficient; robust MAS require deliberate role design and controlled interaction patterns. Moreover, defenses developed in simplified environments often fail to transfer to real-world settings; narrowly scoped defenses may even introduce new vulnerabilities. ACIArena aims to provide a solid foundation for advancing deeper exploration of MAS design principles.

Figures & tables

Figure 1: Overview of ACIArena . Left. How attackers influence benign agents through various attack surfaces. Right. How malicious agents propagate harmful information within the system to achieve the attackers’ objectives. Middle. The process of attack propagation in MAS.

Figure 2: Statistical overview of ACIArena .

Task Domain	MAS	BU	Hijacking		Disruption		Exfiltration
Task Domain	MAS	BU	UA $\uparrow$	ASR $\downarrow$	UA $\uparrow$	ASR $\downarrow$	UA $\uparrow$	ASR $\downarrow$
Math	CAMEL	41.03 ± 0.00	38.46 ± 1.59	7.05 ± 0.00	26.15 ± 1.28	37.44 ± 0.00	33.50 ± 0.75	22.56 ± 1.28
	AutoGen	72.65 ± 3.68	67.74 ± 0.92	19.23 ± 1.59	31.28 ± 1.27	52.65 ± 0.73	58.12 ± 0.73	48.38 ± 0.73
	AgentVerse	74.36 ± 6.37	57.26 ± 0.92	26.71 ± 0.92	34.53 ± 0.73	54.70 ± 0.73	55.21 ± 0.73	40.51 ± 1.28
	Self Consistency	73.50 ± 3.68	59.62 ± 0.00	27.99 ± 0.93	19.49 ± 1.28	74.53 ± 0.73	59.49 ± 0.00	43.59 ± 1.27
	LLM Debate	69.23 ± 6.37	76.92 ± 0.00	16.88 ± 0.92	27.21 ± 1.27	64.79 ± 0.73	62.22 ± 0.73	57.27 ± 0.75

Table 1: Benchmarking results on ACIArena for GPT-4o-mini, darker colors indicate higher values.

Figure 3: ASR of Corba across agent profiles (x-axis) under a fixed topology (y-axis). Configurations A–C are GPT-4o–generated variants. (see details in Appendix E.3 .)

Figure 4: Agent-level average ASR (top) and PVI (bottom) across seven MAS. PVI values are reported with 95% confidence intervals.

Figure 5: Model-level average ASR. Model scales follow the trend: GPT-4o > GPT-4o-mini > Qwen2.5.

MAS	BU	Hijacking		Disruption		Exfiltration
MAS	BU	UA $\uparrow$	ASR $\downarrow$	UA $\uparrow$	ASR $\downarrow$	UA $\uparrow$	ASR $\downarrow$
AutoGen	57.78 ± 4.78	27.50 ± 2.07	92.78 ± 2.39	4.22 ± 1.91	96.44 ± 0.96	32.22 ± 0.96	54.00 ± 0.00
+BERT Detector	45.56 ± 12.65	30.00 ± 2.07	96.39 ± 3.16	2.00 ± 1.66	99.78 ± 0.96	22.67 ± 0.00	36.67 ± 1.66
+Delimiter	55.56 ± 12.65	28.61 ± 1.20	95.56 ± 1.20	6.00 ± 0.00	96.67 ± 1.66	20.22 ± 0.96	44.22 ± 0.96
+Sandwich	66.67 ± 8.28	44.72 ± 1.20	79.72 ± 1.20	14.22 ± 1.91	78.67 ± 1.66	39.56 ± 0.96	60.00 ± 0.00
+AGrail	32.22 ± 4.78	7.50 ± 0.00	35.56 ± 3.16	1.11 ± 2.53	96.44 ± 0.96	14.00 ± 0.00	29.33 ± 1.66

Table 2: Performance of selected MAS with defenses in the Code domain. Gray cells indicate the no-defense setting, and darker colors indicate higher values.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

MAS	UA (%)	ASR (%)
AutoGen	13.33	6.67
+Optimized	0.00	36.67
AgentVerse	60.00	3.33
+Optimized	23.33	13.33
MetaGPT	43.33	0.00
+Optimized	13.33	10.00

Appendix

Table 3: Results of MAS under adaptive attacks. Gray rows indicate the original MAS with ACI-Sentinel .

Figure 6: Average ASR at the attack surface level, computed by averaging the ASR across multiple MAS for each attack surface.

Topology & Pattern	LLM-MAS	# Agents	Task Domain
Vertical $A_{1}\rightarrow A_{2}$	MetaGPT	5	code
Vertical $A_{1}\rightarrow A_{2}$	Self Consistency	6	all
Horizontal $A_{1}\leftrightarrow A_{2}$	AutoGen	2	all
Horizontal $A_{1}\leftrightarrow A_{2}$	Camel	4	all
Hierarchical $A_{1}\rightarrow\{A_{2}\leftrightarrow A_{3}\}\rightarrow A_{4}$	AgentVerse	4	all
	LLM Debate	4	all

Appendix

Table 4: LLM-MAS details.

Model	MAS	Hijacking	Disruption	Exfiltration
GPT-4o	CAMEL	critic	task_specifier	user_proxy
	AutoGen	user_proxy	assistant	assistant
	AgentVerse	critic_0	solver	solver
	Self Consistency	aggregator	aggregator	aggregator
	LLM Debate	aggregator	aggregator	aggregator
GPT-4o-mini	CAMEL	critic	task_specifier	user_proxy

Appendix

Table 5: The most harmful malicious agent under each setting in the Math domain.

Multi-Agent System Security

Multi-agent system security studies attacks, trust, privacy, and defenses in interacting AI agents, including language-model teams, robot swarms, and learned controllers.

See all 179 papers

Architecture Matters for Multi-Agent Security
Apr 25, 2026Ben Hagag, William L. Anderson, Christian Schroeder de Witt +1Multi-Agent Systems Multi-Agent System Security
Carnegie Mellon University · MATS · Oxford Witt Lab +1
Security Considerations for Multi-agent Systems
Mar 9, 2026Tam Nguyen, Moses Ndebugre, Dheeraj ArremsettyAI Agent Security Multi-Agent System Security
Crew Scaler · North Carolina A&T State University
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems
Jul 7, 2026Haowen Xu, Xue Tan, Lei Ma +6LLM Agent Security AI Agent Monitoring
Department of Computer Science, Worcester Polytechnic Institute, MA, USA · School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China +1

Apr 25, 2026J/K move · Enter open · S save

Architecture Matters for Multi-Agent Security

Ben Hagag, William L. Anderson, Christian Schroeder de Witt, Sarah Scheffler

Carnegie Mellon University · MATS · Oxford Witt Lab+1

Multi-Agent Systems Multi-Agent System Security Multi-Agent Communication

Open paper AskPDF arXiv

Multi-agent systems (MAS), composed of networks of two or more autonomous AI agents, have become increasingly popular in production deployments, yet introduce security risks that do not arise in single-agent settings. Even if individual agents exhibit robust security, architectural decisions governing their coordination can create attack surfaces that have not been systematically characterized. In this work, we present an empirical study of how MAS design decisions shape the tradeoff between task performance and attack resistance. Across three agentic environments (browser, desktop, and code) and 13 architectural configurations, we use stagewise evaluations that distinguish planning refusal, execution-stage interception, partial harmful execution, and successful attack completion to study three key design choices: (i) agent roles, which determine how authority and responsibility are allocated; (ii) communication topology, which shapes how and when agents interact; and (iii) memory, which determines the context and state visibility accessible to each agent. We find that multi-agent architectures are more vulnerable than standalone agents in the majority of configurations, with attack success rates varying by up to 3.8x at comparable or higher benign accuracy, and that no single design is universally safer. These results motivate the development of further evaluations that move beyond the security properties of a single agent.

Abstract

Multi-Agent System Security

Explore similar work

Architecture Matters for Multi-Agent Security

Security Considerations for Multi-agent Systems

When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems