ai agent security/multi-agent

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Multi-agent security: trust boundaries and inter-agent communication

Implement trust boundaries between agents. Validate and sanitize inter-agent communications. Prevent privilege escalation through agent chains. Isolate agent execution environments. Apply circuit breakers to prevent cascading failures. Define AgentTrustLevel enum (UNTRUSTED, INTERNAL, PRIVILEGED, SYSTEM) and register each agent with trust level and allowed_recipients list. Use CircuitBreaker pattern (e.g., fail_max=5, reset_timeout=60) per agent to halt if failure threshold reached.

Secure multi-agent bus: message signing and validation

SecureAgentBus validates sender identity against agent_registry, checks circuit breaker state (open = temporarily blocked), validates recipient is in sender's allowed_recipients list, logs unauthorized_message_attempt if not, validates message_type is in sender's allowed_message_types. Before sending, sanitize payload based on sender trust level (UNTRUSTED/INTERNAL agents have system fields stripped). Create signed message with fields: sender, recipient, type, payload (sanitized), timestamp (ISO format), signature (HMAC). When receiving, verify signature, check message freshness (reject if older than 5 minutes to prevent replay), validate recipient matches, then return payload.

MCP Multi-Server Isolation & Cross-Origin Protection

Treat each MCP server as an untrusted, independent security domain. Prevent tool descriptions from one server from referencing or modifying the behavior of tools from another server. Monitor for cross-server data flows, such as credentials from server A appearing in calls to server B. Use an MCP proxy or gateway to enforce isolation policies between servers.

Prompt injection propagates across multiple agents

When multiple agents interact (e.g. a coding agent delegates to a search agent, or a review agent processes output from a coding agent), prompt injection can propagate across agent boundaries. A compromised context in one agent becomes instructions for the next.

Do: Isolate context between chained agents

Treat output from one agent as untrusted input when passed to another agent. Implement context boundaries between agents and do not pass full conversation history or raw tool responses between agents without sanitization. Monitor cross-agent interactions for instruction propagation patterns (e.g. one agent's output instructing another to exfiltrate data or modify files). Validate that sub-agent actions remain within the scope defined by the parent task.

Don't: Chain agents without boundaries or trust sub-agent actions

Do not chain agents without context boundaries—if Agent A is compromised, Agent B should not blindly execute Agent A's output. Do not allow sub-agents to inherit the full permissions and credentials of the parent agent without scope restriction. Do not assume that agent-to-agent communication is trusted because both agents are your tools.

Give your agent this brain