AI Multi-Agent Lab: Hijack a Spawned Sub-Agent

This article describes a vulnerability in multi-agent AI systems where an attacker crafts a user request that causes an orchestrator agent to spawn a sub-agent with a malicious goal while inheriting the parent's tool access but not its input guardrails. The vulnerability exploits the asymmetry between downward privilege propagation and lack of downward guardrail propagation, enabling destructive actions that the parent agent would have blocked. This matters because multi-agent orchestration is increasingly common in AI systems, and this pattern represents a critical trust-propagation flaw that multiplies risk.

• Core vulnerability mechanismOrchestratorBot derives a sub-agent's goal directly from user input, then spawns that sub-agent with inherited tool access. Critically, the guardrails that screened the original user message do not accompany the derived goal, creating a gap where an attacker's crafted request becomes an unvetted sub-agent objective with full parent privileges. The sub-agent executes this goal without the same input scrutiny that would have rejected it at the orchestrator level.
• Attack execution patternAn attacker phrases their request so that when OrchestratorBot translates it into a sub-agent goal, that goal becomes a destructive action like delete_all_logs(). The orchestrator's own refusal mechanisms are bypassed because the sub-agent never evaluates the original malicious request—it only sees the derived goal, which it pursues without guardrails. The sub-agent then executes the tool call that the parent would have blocked.
• Why trust without scrutiny failsThe orchestrator's guardrails vetted the user message, but the sub-agent acts on a goal derived from that message that was never subjected to the same vetting process. Trust flowed downward through privilege inheritance, but the scrutiny that should accompany that trust did not. This asymmetry is the fundamental vulnerability—privileges and guardrails must propagate together or not at all.
• Broader risk in multi-agent systemsThe article identifies this as a manifestation of OWASP LLM06 Excessive Agency, noting that multi-agent orchestration multiplies this risk. Each spawned agent can inherit capability without inheriting the checks designed to govern that capability. As frameworks add more sub-agents and tool delegation, this pattern becomes a central architectural risk rather than an isolated edge case.
• Defense requires guardrails propagationThe article prescribes applying input guardrails not just to the original user message but to derived sub-agent goals. Sub-agents must receive only the minimum tools needed for their specific task—never the parent's full set. Additionally, tool calls must be authorized against the user at every level of the agent tree, and destructive actions must require confirmation regardless of which agent requests them.
• Least privilege at every agent levelRather than giving spawned sub-agents all inherited tools from the parent, each should operate under least-privilege constraints tied to its specific goal. The article emphasizes mapping what each spawned agent can do and what screens its goal as an elite-level defensive practice. This prevents a compromised or redirected sub-agent from having access to capabilities it should never need.
• Real-world applicabilityThe vulnerability is not theoretical; the article notes this pattern emerges as agent frameworks increasingly use sub-agents and tool delegation. Systems that follow the orchestrator-spawned-sub-agent model without addressing guardrail propagation face this risk in production environments where multi-agent task decomposition is standard.

Bottom line: In multi-agent systems, privileges and guardrails must propagate together—spawning a sub-agent with inherited tool access but without inherited input screening creates a critical vulnerability where an attacker can hijack the sub-agent's goal. Defend by screening derived goals, enforcing least privilege per agent, authorizing tool calls at every level, and confirming destructive actions regardless of agent source.