Summary
When multiple AI agents work together to complete tasks, a central system assigns roles based on the descriptions of each agent. The authors found that if someone provides a misleading description for a new agent before any task starts, it can confuse the planner and disrupt the entire task, even if the fake agent is never actually used. They showed this problem happens with real-world agent profiles, significantly lowering task success and increasing resource use. To fix this, they created a defense that filters out harmful information from agent descriptions before it reaches the planner, restoring normal system performance without changing the underlying agents or planner.
Authors
Zhaofeng Yu, Haokai Ma, Dongyang Zhan, Hongli Zhang, Han Fang, Ee-Chien Chang
Abstract
A centralized LLM-based multi-agent system (MAS) extends its functionality by registering new worker agents, whose descriptions are read by the planner to decide how a task is decomposed, which worker executes each subtask, and what each subtask requires. Third-party descriptions are authored outside the system but trusted by the planner, creating a registration-time injection channel. The payload is planted before any user instruction arrives, targets the planner and propagates through the generated plan to benign workers, taking effect even when the crafted worker is never assigned a subtask or invoked. We define four worker-description fields: functionality, input specification, output specification, and usage constraints. Among 32,000 descriptions from three public agent marketplaces, most omit input specifications and usage constraints, while at least 23.35% contain content outside these fields. We construct eight description-manipulation attack strategies targeting task decomposition, capability grounding, and subtask specification, and evaluate them on GAIA. In the most severe cases, a single manipulated description reduces task success from 84.31% to 37.25%, or increases token consumption or execution time by over 111%, while the user objective remains unchanged and workers faithfully execute the resulting plan. These effects persist across two MAS implementations, six planner LLMs, four LLM evaluators, and the real-world descriptions from three marketplaces. We further propose DescGuard, a registration-time defense that retains only worker-scoped interface information before descriptions reach the planner. DescGuard restores the targeted planning metrics and downstream performance toward their baseline levels without modifying worker implementations, the planner, or the orchestration logic, and composes with existing isolation, permission-control, and runtime mechanisms.