CoChat
Sign Up
PreprintCited by 2

The DOI matches its DataCite record; 2 of the 2 references it cites were found in a registry or an index.

OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage

Naik, Akshat, Culligan, Jay, Gal, Yarin, Torr, Philip, Aljundi, Rahaf, Paren, Alasdair, Bibi, Adel·2026·arXiv
DOI 10.48550/arxiv.2602.13477arXiv 2602.13477
Open this paper in CoChat — free account

Abstract

As Large Language Model (LLM) agents become more capable, their coordinated use in the form of multi-agent systems is anticipated to emerge as a practical paradigm. Prior work has examined the safety and misuse risks associated with agents. However, much of this has focused on the single-agent case and/or setups missing basic engineering safeguards such as access control, revealing a scarcity of threat modeling in multi-agent systems. We investigate the security vulnerabilities of a popular multi-agent pattern known as the orchestrator setup, in which a central agent decomposes and delegates tasks to specialized agents. Through red-teaming a concrete setup representative of a likely future use case, we demonstrate a novel attack vector, OMNI-LEAK, that compromises several agents to leak sensitive data through a single indirect prompt injection, even in the presence of data access control. We report the susceptibility of frontier models to different categories of attacks, finding that both reasoning and non-reasoning models are vulnerable, even when the attacker lacks insider knowledge of the implementation details. Our work highlights the importance of safety research to generalize from single-agent to multi-agent settings, in order to reduce the serious risks of real-world privacy breaches and financial losses and overall public trust in AI agents.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2602.13477

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 2 references

Research works printed but not linked: 22

  1. Andriushchenko, M., Souly, A., Dziemian, M., Duenas, D., Lin, M., Wang, J., Hendrycks, D., Zou, A., Kolter, J. Z., Fredrikson, M., Gal, Y., and Davies, X. Agentharm: A benchmark for measuring harmfulness of LLM agents. In International Conference on Learning Representations, 2025.
  2. Anwar, U., Saparov, A., Rando, J., Paleka, D., Turpin, M., Hase, P., Lubana, E. S., Jenner, E., Casper, S., Sourbut, O., Edelman, B. L., Zhang, Z., Günther, M., Korinek, A., Hernandez-Orallo, J., Hammond, L., Bigelow, E., Pan, A., Langosco, L., Korbak, T., Zhang, H., Zhong, R., hÉigeartaigh, S. O., Recchia, G., Corsi, G., Chan, A., Anderljung, M., Edwards, L., Petrov, A., de Witt, C. S., Motwan, S. R., Bengio, Y., Chen, D., Torr, P. H. S., Albanie, S., Maharaj, T., Foerster, J., Tramer, F., He, H., Kasirzadeh, A., Choi, Y., and Krueger, D. Founda- tional challenges in assuring alignment and safety of large language models. Transactions on Machine Learning Re- search, 2024.
  3. Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., Agarwal, S., Herbert-Voss, A., Krueger, G., Henighan, T., Child, R., Ramesh, A., Ziegler, D. M., Wu, J., Winter, C., Hesse, C., Chen, M., Sigler, E., Litwin, M., Gray, S., Chess, B., Clark, J., Berner, C., McCandlish, S., Radford, A., Sutskever, I., and Amodei, D. Language models are few-shot learners. In Advances in Neural Information Processing Systems, 2020.
  4. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., and Fritz, M. Not what you've signed up for: Com- promising real-world llm-integrated applications with in- direct prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, 2023.
  5. Jones, E., Dragan, A., and Steinhardt, J. Adversaries can misuse combinations of safe models. In International Conference on Machine Learning, 2025.
  6. Kutasov, J., Sun, Y., Colognese, P., van der Weij, T., Petrini, L., Zhang, C. B. C., Hughes, J., Deng, X., Sleight, H., Tracy, T., Shlegeris, B., and Benton, J. Shade-arena: Evaluating sabotage and monitoring in llm agents. arXiv preprint arXiv:2506.15740, 2025. · arXiv
  7. Liu, Y., Deng, G., Li, Y., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y., Wang, H., Zheng, Y., and Liu, Y. Prompt injection attack against llm-integrated applica- tions. arXiv preprint arXiv:2306.05499, 2024a. · arXiv
  8. Liu, Y., Deng, G., Xu, Z., Li, Y., Zheng, Y., Zhang, Y., Zhao, L., Zhang, T., Wang, K., and Liu, Y. Jailbreaking chat- gpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860, 2024b. Microsoft. Multi-agent orchestration, maker controls, and more: Microsoft copilot stu- dio announcements at microsoft build 2025. https://www.microsoft.com/en-us/ microsoft-copilot/blog/copilot-studio/ multi-agent-orchestration-maker- controls-and-more-microsoft-copilot- studio-announcements-at-microsoft- build-2025/, 2025a. Accessed 2025-06-19. · arXiv
  9. Parthasarathy, K., Vaidhyanathan, K., Dhar, R., Krishna- machari, V., Kakran, A., Akshathala, S., Arun, S., Karan, A., Muhammed, B., Dubey, S., and Veerubhotla, M. En- gineering LLM Powered Multi-Agent Framework for Au- tonomous CloudOps . In International Conference on AI Engineering -Software Engineering for AI, 2025.
  10. Patil, S. G., Zhang, T., Wang, X., and Gonzalez, J. E. Go- rilla: Large language model connected with massive apis. In Advances in Neural Information Processing Systems, 2024.
  11. Pedro, R., Coimbra, M. E., Castro, D., Carreira, P., and Santos, N. Prompt-to-sql injections in llm-integrated web applications: Risks and defenses. In International Conference on Software Engineering, 2025.
  12. Perez, E., Huang, S., Song, F., Cai, T., Ring, R., Aslanides, J., Glaese, A., McAleese, N., and Irving, G. Red teaming language models with language models. In Conference on Empirical Methods in Natural Language Processing, 2022.
  13. Perez, F. and Ribeiro, I. Ignore previous prompt: At- tack techniques for language models. arXiv preprint arXiv:2211.09527, 2022. · arXiv
  14. Qin, Y., Liang, S., Ye, Y., Zhu, K., Yan, L., Lu, Y., Lin, Y., Cong, X., Tang, X., Qian, B., Zhao, S., Hong, L., Tian, R., Xie, R., Zhou, J., Gerstein, M., Li, D., Liu, Z., and Sun, M. ToolLLM: Facilitating large language models to master 16000+ real-world APIs. In International Conference on Learning Representations, 2024.
  15. Schick, T., Dwivedi-Yu, J., Dessí, R., Raileanu, R., Lomeli, M., Hambro, E., Zettlemoyer, L., Cancedda, N., and Scialom, T. Toolformer: language models can teach them- selves to use tools. In Advances in Neural Information Processing Systems, 2023.
  16. Schoen, B., Nitishinskaya, E., Balesni, M., Højmark, A., Hofstätter, F., Scheurer, J., Meinke, A., Wolfe, J., van der Weij, T., Lloyd, A., Goldowsky-Dill, N., Fan, A., Matveiakin, A., Shah, R., Williams, M., Glaese, A., Barak, B., Zaremba, W., and Hobbhahn, M. Stress testing deliberative alignment for anti-scheming training. arXiv preprint arXiv:2509.15541, 2025. · arXiv
  17. ServiceNow. Servicenow platform introduces ai agent orchestrator, 2025. URL https: //www.servicenow.com/company/media/ press-room/ai-agents-studio.html. Ac- cessed: 2025-04-27.
  18. Sharma, G., Kulkarni, V., King, M., and Huang, K. Towards unifying quantitative security benchmarking for multi- agent systems. arXiv preprint arXiv:2507.21146, 2025. · arXiv
  19. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., and Polosukhin, I. Atten- tion is all you need. In Advances in Neural Information Processing Systems, 2017.
  20. Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., and Cao, Y. ReAct: Synergizing reasoning and act- ing in language models. In International Conference on Learning Representations, 2023.
  21. Zhang, B., Tan, Y., Shen, Y., Salem, A., Backes, M., Zannet- tou, S., and Zhang, Y. Breaking agents: Compromising autonomous llm agents through malfunction amplifica- tion. arXiv preprint arXiv:2407.20859, 2024. · arXiv
  22. Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., and Fredrikson, M. Universal and transferable adversar- ial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. · arXiv

Cited by

Sorted by citations

Metadata

Authors
Naik, A., Culligan, J., Gal, Y., Torr, P., Aljundi, R., Paren, A., & Bibi, A.
Venue
arXiv
Publisher
arXiv
Published
2026
DOI
10.48550/arxiv.2602.13477
arXiv
2602.13477
References
2
Type
Preprint
Licence
creativecommons.org/licenses/by/4.0/legalcode

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review