FlagThis

Abstract

Hierarchical multi-agent systems (MAS) are rapidly deployed in high-stakes workflows across various domains such as finance and software engineering. In these systems, safety and security are inherently distributed across role-specialized subagents, significantly expanding the attack surface, especially for risk involving coordination, such as privilege escalation and cross-agent collusion. Existing redteaming approaches against MAS remain limited: they rely on heuristic selection of target agents and perturb isolated message streams, leaving critical questions unanswered as which agents are most responsible for system safety, and how compromised agents can coordinate to bypass defenses . To bridge these gaps, we propose MASTRIKE, a closed-loop framework for collusive red-teaming in hierarchical MAS. We propose the first agent-level Shapley value analysis for MAS, quantifying each agents marginal contribution to system robustness under task-specific distributions. Building on this principled attribution, we design an autonomous red-teaming agent guided by Shapley values to identify vulnerable coalitions and generate coordinated, role-aware adversarial manipulations. These attacks are iteratively refined through structured failure diagnosis, identifying blocking conditions and refining the injections accordingly. In addition, we construct a comprehensive MAS red-teaming benchmark, MABENCH, spanning diverse hierarchical topologies and domains, including finance, software engineering, and CRM. We construct controllable MAS environments to perform risk assessment in MAS with agent collusion optimization. Extensive experiments across MAS structures with different frontier models demonstrate that MASTRIKE significantly outperforms existing heuristic baselines, achieving 61.8% ASR against Claude Opus 4.7 and 55.6% against GPT-5.5. Our analysis on real-world MAS further uncovers non-trivial Shapley distributions and complex agent interactions, revealing critical vulnerabilities overlooked by prior single-agent or template-based methods.