A survey of nearly 200 research papers makes a blunt case: hooking multiple AI agents together creates security holes that don't show up when you check each agent on its own.
The paper, posted to arXiv, reviews 197 works on multi-agent LLM systems - setups where several AI agents pass information, decisions, and authority to each other. The authors built a framework called A-I-R that sorts attacks by where the attacker sits, which interface they use to interact with the system, and what damage results. They catalog six ways agents interact, four attacker positions, seven system-level risks, and eight recurring attack paths. They also reviewed 44 benchmark and evaluation papers and found most struggle to isolate what's actually going wrong when agents interact, or to measure it in ways that transfer across different multi-agent designs.
The core argument matters because most AI security testing still treats agents like standalone chatbots: does this one refuse bad instructions, does that one leak data. But a system of individually well-behaved agents can still fail once you let them hand tasks and trust to each other - the failure lives in the handoffs, not any single agent. As companies rush to chain agents together for coding, research, and customer service, that's exactly the layer current safety evaluations tend to skip.
It's the security world's oldest lesson showing up in a new stack: a chain is only as strong as its weakest link, and nobody's been stress-testing the links.