title: Multi-Agent Consensus Sybil Attack
id: ATR-2026-00108
rule_version: 1
status: experimental
description: |
  Detects attempts to manipulate multi-agent consensus or voting systems through
  Sybil-style attacks. This includes instructions to create multiple fake agent
  identities, coordinate votes across agents, or systematically submit false
  proposals to overwhelm legitimate consensus mechanisms. In multi-agent
  architectures where decisions require agreement among agents, an attacker may
  instruct one agent to impersonate multiple identities or coordinate with
  compromised agents to swing votes.
author: ATR Community
date: 2026/03/16
schema_version: '0.1'
detection_tier: semantic
maturity: test
severity: critical
source: threat-cloud
references:
  owasp_agentic:
    - ASI10:2026
    - ASI07:2026
    - ASI01:2026
  mitre_atlas:
    - AML.T0043 - Craft Adversarial Data
  owasp_llm:
    - LLM01:2025
compliance:
  eu_ai_act:
    - article: '14'
      context: Consensus Sybil attacks allow compromised agents to manufacture false agreement in multi-agent decision systems, directly undermining the human oversight capability Article 14 requires for high-risk AI applications.
      strength: primary
    - article: '15'
      context: Article 15 robustness requirements mandate that high-risk AI systems resist adversarial manipulation; Sybil attacks on consensus mechanisms are a documented adversarial pattern requiring systematic detection.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (Multi-Agent Consensus Sybil Attack).
      strength: secondary
  nist_ai_rmf:
    - subcategory: GV.1.2
      context: Consensus Sybil attacks exploit undefined accountability for agent identity in multi-agent systems; GV.1.2 requires that accountability roles for AI risk management are defined and assigned to prevent Sybil-style identity fabrication.
      strength: primary
    - subcategory: MG.2.3
      context: Sybil attacks represent a documented risk treatment gap in multi-agent consensus deployments; MG.2.3 requires that risk treatment plans are implemented for identified AI risks, including detection controls for fake-identity flooding.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (Multi-Agent Consensus Sybil Attack).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: Multi-agent systems deploying consensus mechanisms must include Sybil attack detection as a planned risk treatment activity under the AI objectives framework required by clause 6.2.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 operational controls must ensure that consensus decisions are made by verified agent identities and that fabricated voter identities are detected before they influence multi-agent outcomes.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: consensus-sybil-attack
  scan_target: mcp
  confidence: medium
agent_source:
  type: multi_agent_comm
  framework:
    - autogen
    - crewai
    - langchain
    - langgraph
    - swarm
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:create|register|spawn)\s+(?:multiple|several|many|\d+)\s+(?:fake|false|sybil|dummy|puppet)\s+(?:agents?|identit(?:y|ies)|accounts?|voters?|participants?)
      description: Instructions to create multiple fake identities for consensus manipulation
    - field: content
      operator: regex
      value: (?i)(?:vote|approve|reject|endorse)\s+(?:as|using|from|with)\s+(?:multiple|different|various|all)\s+(?:\w+\s+)?(?:agents?|identit(?:y|ies)|accounts?|personas?)
      description: Instructions to vote using multiple identities
    - field: content
      operator: regex
      value: (?i)(?:flood|overwhelm|spam|stuff)\s+(?:the\s+)?(?:vote|ballot|proposal|consensus|poll)\s+(?:system|mechanism|process)
      description: Instructions to flood voting or consensus systems
    - field: content
      operator: regex
      value: (?i)(?:coordinate|synchronize|orchestrate)\s+(?:the\s+)?(?:votes?|proposals?|approvals?)\s+(?:across|between|among)\s+(?:(?:all|the|compromised|multiple)\s+)*(?:agents?|bots?|accounts?|identit(?:y|ies))
      description: Coordinated voting across multiple agent identities
    - field: content
      operator: regex
      value: (?i)(?:impersonate|pretend\s+to\s+be|pose\s+as)\s+(?:multiple|different|various)\s+(?:agents?|reviewers?|voters?|participants?|community\s+members?)
      description: Impersonation of multiple participants in consensus
  condition: any
  false_positives:
    - Security research discussing Sybil attack patterns
    - Documentation about consensus mechanism design
    - Academic paper discussing Sybil attack theory in distributed systems that uses phrases like 'creating multiple fake identities' in quoted threat model descriptions
    - Penetration testing report documenting consensus manipulation techniques with example attack payloads included verbatim
response:
  actions:
    - block_tool
    - alert
    - snapshot
confidence: 73
wild_validated: 2026/04/08
wild_samples: 53577