title: Cross-Agent Attack Detection
id: ATR-2026-00030
rule_version: 1
status: stable
description: |
  Consolidated detection for cross-agent attacks in multi-agent systems,
  covering both impersonation and prompt injection vectors. Detects when
  one agent spoofs another agent's identity, injects manipulative
  instructions into inter-agent messages, forges system-level message tags,
  attempts orchestrator bypass, injects fake status or error messages,
  or manipulates message format conventions to deceive target agents.
  These attacks exploit trust relationships between agents to achieve
  unauthorized actions, data exfiltration, or safety bypass.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
confirm: embedding
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI01:2026
    - ASI07:2026
    - ASI10:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0043 - Craft Adversarial Data
    - AML.T0052.000 - Spearphishing via Social Engineering LLM
compliance:
  owasp_agentic:
    - id: ASI01:2026
      context: Detects agent goal hijack when an attacker spoofs a peer agent's identity to inject manipulative instructions into inter-agent messages.
      strength: primary
    - id: ASI07:2026
      context: Directly addresses insecure inter-agent communication by flagging forged system-level message tags and manipulated message format conventions.
      strength: primary
    - id: ASI10:2026
      context: Surfaces rogue agents attempting orchestrator bypass or fake status-message injection against trusted peers.
      strength: secondary
  owasp_llm:
    - id: LLM01:2025
      context: Inter-agent prompt injection is a prompt-injection vector operating at the agent-to-agent boundary rather than the user-to-agent boundary.
      strength: primary
    - id: LLM06:2025
      context: Excessive agency is what an attacker exploits when cross-agent spoofing succeeds — the target agent takes actions it would not otherwise take.
      strength: secondary
  eu_ai_act:
    - article: 12
      clause: Automatic logging for high-risk AI systems
      context: Every cross-agent attack detection emits a log record with actor agent, target agent, timestamp, payload hash, and rule match — supporting Article 12's continuous logging requirement.
      strength: primary
    - article: 14
      clause: Human oversight
      context: Critical-severity detections route to the respond-agent human-in-the-loop flow before allowing the attacker-controlled inter-agent call to complete.
      strength: primary
    - article: 15
      clause: Accuracy, robustness, and cybersecurity
      context: Cross-agent attack detection is a cybersecurity control contributing to the Article 15 robustness requirement for high-risk AI systems.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (Cross-Agent Attack Detection).
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Contributes detection evidence to incident response playbooks; each match is an incident candidate for the respond-agent pipeline.
      strength: primary
    - function: Govern
      subcategory: GV.1.1
      context: Logs support organizational AI governance by recording every inter-agent communication risk event for quarterly governance review.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Cross-Agent Attack Detection).
      strength: primary
  iso_42001:
    - clause: '6.2'
      clause_name: AI risk treatment
      context: Cross-agent impersonation is an identified AI threat vector; this rule is the operational risk-treatment control.
      strength: primary
    - clause: '9.1'
      clause_name: Monitoring, measurement, analysis, evaluation
      context: Confidence-scored detection events feed the AIMS monitoring and measurement requirements.
      strength: secondary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the agent-manipulation technique (Cross-Agent Attack Detection).
      strength: primary
tags:
  category: agent-manipulation
  subcategory: cross-agent-attack
  scan_target: mcp
  confidence: high
agent_source:
  type: multi_agent_comm
  framework:
    - autogen
    - crewai
    - langchain
    - langgraph
    - swarm
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:i\s+am|this\s+is|speaking\s+as|responding\s+as|acting\s+as)\s+(?:the\s+)?(?:admin|supervisor|orchestrator|manager|controller|system|root)\s+agent
      description: Agent claiming to be a privileged agent role
    - field: content
      operator: regex
      value: (?i)(?<!["'`])(?:ignore|disregard|forget|override|overwrite)\s+(?:all\s+)?(?:your\s+)?(?:previous|prior|above|earlier|existing)\s+(?:instructions?|rules?|constraints?|guidelines?|prompt|directives?)
      description: Instruction override attempt in inter-agent message (must be a live directive, not a quoted/listed mention in security docs — negative lookbehind excludes quote/backtick-prefixed occurrences)
    - field: content
      operator: regex
      value: (?i)(?<!["'`])(?<!:\s)(?:\[\s*(?:OVERRIDE|ROOT|SUDO)\s*\]|<<\s*SYS\s*>>|<\|im_start\|>system)
      description: 'Fake system-level message tags in agent communication (common benign labels [SYSTEM]/[ADMIN]/[PRIORITY]/[URGENT] dropped; kept override/root/sudo tags and chat-template markers). Negative lookbehinds require a live forged role marker: excludes quoted/backticked doc references and YAML/JSON mapping values (parent_ids: [root])'
    - field: content
      operator: regex
      value: (?i)(?<!["'`])(?:new\s+instructions?|updated\s+(?:prompt|directive)|revised\s+(?:rules?|orders?)|emergency\s+(?:override|protocol))\s*[:=]
      description: Attempt to inject new instructions via agent messages (live directive only; negative lookbehind excludes quoted/listed occurrences in prompt-injection detection docs)
    - field: content
      operator: regex
      value: (?i)(?:you\s+are\s+now|from\s+now\s+on|henceforth|going\s+forward|effective\s+immediately)\s+(?:(?:a|an|the)\s*)?(?:(?:unrestricted|unfiltered|jailbroken)\s*)?[a-zA-Z]+\s+(?:agent|assistant|bot)
      description: Attempt to redefine target agent's identity or role
    - field: content
      operator: regex
      value: (?i)(?:do\s+not|don'?t|never)\s+(?:tell|inform|alert|notify|report|mention|log|record)\s+(?:the\s+)?(?:user|admin|orchestrator|supervisor|human|monitor)(?!s?\s+to\b)(?!\s+about\s+(?:each|every|individual)\b)
      description: Instruction to hide actions from oversight (excludes benign coaching form 'never tell users to <verb>' via the first negative lookahead; the second excludes output-verbosity control, 'do not tell the user about each|every|individual <step>', which scopes down per-item progress narration rather than concealing a fact — a report-building skill triggered this on 'Don't tell the user about each tool call as you make it'. Concealment form 'do not tell the user about <fact>' is kept)
    - field: content
      operator: regex
      value: (?i)(?:acting|speaking|operating)\s+(?:on\s+behalf\s+of|as\s+(?:a\s*)?proxy\s+for|in\s+place\s+of)\s+[a-zA-Z0-9_-]+\s*(?:agent)?
      description: Agent claiming to act on behalf of another agent
    - field: content
      operator: regex
      value: (?i)(?:override|bypass|elevate|escalate)\s+(?:my|this|your|the)\s+(?:identity|role|permissions?|access|privileges?)\s+(?:to|as|with)
      description: Explicit attempt to override identity or permissions
    - field: content
      operator: regex
      value: (?i)(?:status|error|result)\s*[:=]\s*(?:failed|error|timeout|unauthorized).{0,80}(?:fallback|use\s+alternative|switch\s+to)
      description: Fake error or status injection to trigger fallback behavior (requires a behavior-redirect directive fallback/switch-to/use-alternative within 80 chars; bare 'retry' dropped as it matches benign error-handling prose)
    - field: content
      operator: regex
      value: (?i)(?:message_type|msg_type)\s*[:=]\s*["']?(?:admin|orchestrator|supervisor|root)["']?
      description: Message format manipulation to spoof privileged inter-agent message roles (bare role:system dropped — legitimate chat-message format)
    - field: content
      operator: regex
      value: (?i)agent[_-]?id\s*[:=]\s*["']?(?:admin|system|orchestrator|supervisor|root)["']?
      description: Agent ID field set to privileged agent identity
    - field: content
      operator: regex
      value: (?i)(?:priority\s*[:=]\s*override|\[PRIORITY:\s*OVERRIDE\])
      description: Fake priority escalation to bypass normal processing (benign priority:critical/urgent/emergency dropped; only explicit override framing kept)
    - field: content
      operator: regex
      value: (?i)(?:transfer|forward|route|redirect)\s+(?:all|any|this)\s+(?:data|output|results?|responses?)\s+to\s+(?:https?://|ftp://|\d{1,3}\.\d{1,3})
      description: Data exfiltration directive via inter-agent redirect
  condition: any
  false_positives:
    - Legitimate agent delegation where one agent is authorized to act on behalf of another
    - Orchestrator agent routing messages with original sender metadata
    - Agent discussing prompt injection as a topic in security-related tasks
    - Authorized system reconfiguration commands through proper admin channels
response:
  actions:
    - block_input
    - escalate
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 1/13601 = 0.01% meets the 0.5% ceiling but is not zero; ceiling = degrade. Removed quarantine_session(terminate), kill_agent(terminate). Detection unchanged — recall cost is zero.'
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-030] CRITICAL: Cross-agent attack detected. Agent {agent_id}
    attempted impersonation, instruction injection, or message manipulation
    in inter-agent communication. Message blocked, source agent quarantined.
    Session: {session_id}. Immediate investigation required.
confidence: 87
wild_validated: 2026/04/08
wild_samples: 53577