The transition from monolithic Single-Agent Systems (SAS) to Multi-Agent Systems (MAS) introduces critical "structural attack surfaces" derived from inter-agent delegation and interaction logic. Using the WebMASLab framework, researchers have identified the "Telephone Loop" exploit, a mechanism that leverages cross-agent delegation to trigger recursive, resource-exhausting task cycles. Empirical testing against frontier models, including GPT-5.2 and Claude Sonnet 4.5, demonstrates an 80% average attack success rate (ASR) at baseline. Current defenses, such as prompt-hardening, exhibit non-linear efficacy and fail to provide generalized protection, leaving distributed agentic architectures vulnerable to systemic failure and resource exhaustion.

• Research Framework: WebMASLab and MAS Taxonomy
  • Introduction of a formal MAS Attack Taxonomy to classify vulnerabilities unique to multi-agent web environments.
  • Deployment of the WebMASLab test-bed to isolate architectural vulnerabilities from browser or tool-based substrates.
  • Identification of "structural attack surfaces" emerging from agent role decomposition and task specialization.
• Vulnerability Mechanics: The Telephone Loop
  • Leverages cross-agent delegation to induce cyclical, resource-exhausting task execution loops.
  • Targets the interaction and orchestration logic between agents rather than individual model parameters.
  • Functions as a systemic exhaustion vector, potentially compromising the entire MAS workflow through recursive calls.
• Empirical Exploitation Status
  • Achieved an average 80% Attack Success Rate (ASR) across GPT-5.2, GPT-5.4, and Claude Sonnet 4.5 at baseline.
  • Baseline testing showed 0% detection rates for Telephone Loop attacks across most frontier models.
  • Claude Sonnet 4.6 emerged as a significant outlier, demonstrating a 92% detection rate for this specific vector.
• Defense and Mitigation Analysis
  • Prompt-hardening shows inconsistent, non-linear efficacy, with max detection rates peaking at only 33% for most models.
  • Standard hardening failed to significantly impact ASR in several high-performing frontier models.
  • Current LLM defensive mechanisms lack the generalized logic required to secure inter-agent communication protocols.
• Conclusion
  • The shift toward MAS necessitates a paradigm shift from single-model hardening to systemic interaction security.
  • Security architectures must prioritize the integrity of delegation logic and task hand-off protocols.