---
source: arxiv
url: https://arxiv.org/abs/2605.08460v1
published_at: '2026-05-08T20:27:23'
authors:
- Ziwen Cai
- Yihe Zhang
- Xiali Hei
topics:
- multi-agent-security
- agent-network
- subagent-spawning
- prompt-injection
- access-control
- llm-agents
relevance_score: 0.82
run_id: materialize-outputs
language_code: en
---

# When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks

## Summary
The paper argues that subagent spawning can spread a local agent compromise through inherited memory, broad resource access, stale state, and weak termination controls. It offers a formal role-based model and defenses for safer multi-agent agent systems.

## Problem
- It studies what happens after one LLM agent in a multi-agent network is compromised through prompt injection, jailbreaking, poisoned data, or a malicious skill.
- The risk matters because spawned subagents may inherit parent memory, permissions, and instructions, so a single compromised agent can affect later delegation and downstream actions.
- Current agent systems often create and terminate agents at runtime with limited human review, which makes access control and lifecycle rules harder to enforce.

## Approach
- The paper models a role-based multi-agent network as agents, parent-child edges, roles, capabilities, resources, memory modes, lifespan modes, and interaction modes.
- It defines three memory inheritance modes: full inheritance, partial inheritance, and no parent-memory inheritance.
- It states security invariants for termination scope, memory isolation, and role-bounded resource access.
- It tests the model against real systems, with OpenClaw as the main target and Hermes and Agent Zero as comparison systems.
- It proposes defenses: an Agent Capability Registry with policy decision and enforcement points, role-scoped memory projection, and revision-based memory synchronization.

## Results
- The excerpt reports 4 vulnerability classes: unrestricted memory inheritance, absent resource access control, asynchronous memory divergence, and unauthorized cross-agent termination.
- The authors say they built working proof-of-concept exploits against a stock OpenClaw deployment for every vulnerability class.
- They report confirmation across 5 additional LLM vendors, which supports the claim that the bugs come from orchestration-layer design rather than one model provider.
- The study evaluates 3 open-source multi-agent systems: OpenClaw, Hermes, and Agent Zero.
- The excerpt gives no attack success rates, latency numbers, user-study results, or benchmark scores; its strongest quantitative claims are the 4 vulnerability classes, 3 tested systems, and 5 additional vendor confirmations.

## Link
- [https://arxiv.org/abs/2605.08460v1](https://arxiv.org/abs/2605.08460v1)