Multi-agent AI systems look safer than they are: the data they leak mostly travels between agents, not to end users.
Researchers published AgentLeak, a benchmark that instruments seven communication pathways inside multi-agent LLM systems rather than just checking final outputs. Testing five production models (GPT-4o, GPT-4o-mini, Claude 3.5 Sonnet, Mistral Large, and Llama 3.3 70B) across 1,000 scenarios in healthcare, finance, legal, and corporate contexts, the team found a pattern that repeats across every model and domain: splitting work across multiple agents lowers final-output leakage from 43.2% to 27.2%, but inter-agent messages leak sensitive data at 68.8%. Total system exposure reaches 68.9% once internal channels are counted. Output-only audits miss 41.7% of violations.
This matters because the enterprise AI market is converging on multi-agent architectures — orchestrators delegating tasks to specialized sub-agents — precisely the setup that generates the highest internal leakage. Companies in regulated industries running compliance checks on AI outputs are, by this research, auditing the wrong channel. The finding held consistently across all five models and all four domains, pointing to the architecture rather than any specific vendor's implementation.
Swapping GPT-4o for Llama won't fix this. Privacy risk in multi-agent AI appears structural, which is a harder conversation to have when the industry is still selling that same architecture as the answer to single-model limitations.