Recoleta
GitHub
Source note

When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks

Authors
Ziwen Cai, Yihe Zhang, Xiali Hei
Source
arXiv
Published
Collection
Software Intelligence
Multi Agent SecurityAgent NetworkSubagent SpawningPrompt InjectionAccess Control
Open arXivMarkdown source

Summary

The paper argues that subagent spawning can spread a local agent compromise through inherited memory, broad resource access, stale state, and weak termination controls. It offers a formal role-based model and defenses for safer multi-agent agent systems.

Problem

  • It studies what happens after one LLM agent in a multi-agent network is compromised through prompt injection, jailbreaking, poisoned data, or a malicious skill.
  • The risk matters because spawned subagents may inherit parent memory, permissions, and instructions, so a single compromised agent can affect later delegation and downstream actions.
  • Current agent systems often create and terminate agents at runtime with limited human review, which makes access control and lifecycle rules harder to enforce.

Approach

  • The paper models a role-based multi-agent network as agents, parent-child edges, roles, capabilities, resources, memory modes, lifespan modes, and interaction modes.
  • It defines three memory inheritance modes: full inheritance, partial inheritance, and no parent-memory inheritance.
  • It states security invariants for termination scope, memory isolation, and role-bounded resource access.
  • It tests the model against real systems, with OpenClaw as the main target and Hermes and Agent Zero as comparison systems.
  • It proposes defenses: an Agent Capability Registry with policy decision and enforcement points, role-scoped memory projection, and revision-based memory synchronization.

Results

  • The excerpt reports 4 vulnerability classes: unrestricted memory inheritance, absent resource access control, asynchronous memory divergence, and unauthorized cross-agent termination.
  • The authors say they built working proof-of-concept exploits against a stock OpenClaw deployment for every vulnerability class.
  • They report confirmation across 5 additional LLM vendors, which supports the claim that the bugs come from orchestration-layer design rather than one model provider.
  • The study evaluates 3 open-source multi-agent systems: OpenClaw, Hermes, and Agent Zero.
  • The excerpt gives no attack success rates, latency numbers, user-study results, or benchmark scores; its strongest quantitative claims are the 4 vulnerability classes, 3 tested systems, and 5 additional vendor confirmations.

Link