The paper models the sub-agent inheritance attack surface in multi-agent networks

Can an already compromised agent spread compromise across a multi-agent network through memory inheritance during sub-agent generation and orchestration-layer flaws.

• Scenario: The authors state that agents can be continuously created and terminated by other agents at runtime, with limited human oversight at each lifecycle transition. Inherited memory can bring malicious instructions, stale state, or unexpected behavior rules into newly created sub-agents, letting local compromise cross agent boundaries.
• Existing gaps: The authors state that single-point compromises such as prompt injection, jailbreak, poisoned retrieval, and malicious extensions have been studied, but how compromise spreads within a network after the fact is less understood. Traditional PKI, access control lists, and firewalls target relatively stable subjects and cannot directly constrain capability propagation between dynamic instances.
• Core judgment: The authors believe current frameworks violate trust boundaries through unsafe memory inheritance, weak resource control, post-generation stale state, and improper termination rights. These are classified as orchestration-layer structural flaws rather than behavior of any single vendor model.
• What this paper does: The authors give a formal model of role-based multi-agent networks, write memory isolation, access control, and termination scope as checkable invariants, do proof-of-concept (PoC) on a real framework, and propose defenses that restore these invariants. The authors state that to their knowledge this is the first systematic analysis of these issues.
• Threat model:
  • Goal: Break integrity and control flow, cause harmful actions on the user side, and affect the creation and coordination of future sub-agents.
  • Knowledge: No assumption of compromising the host, OS, or enterprise network; the attack starts at the application/agent layer. Initial prompt injection and jailbreak are treated as known and are not the object of this paper.
  • Capability: Compromise at least one instance; can inject malicious instructions or backdoor logic into outputs, intermediate messages, or creation prompts, then affect downstream through delegation chains and inter-agent communication. Normal interaction channels suffice.
  • Environment: The user submits benign tasks but usually cannot verify intermediate decisions item by item; at the start the infrastructure is not directly compromised. Physical attacks and non-agent channels are out of scope.

LLM and agent security

• Model-layer surveys: Das et al. (2025) and Berini et al. (2026) cover threats across the model lifecycle; OWASP Top 10 (2025) lists prompt injection as the top risk.
• Agent systems: Raza et al. (2025), Lazer et al. (2026), Sibai et al. (2026), and Wu et al. (2024) extend the discussion to agent systems and deployed systems.
• Classic principles: Zhang et al. (2025) advocates principles such as least privilege for agents, echoing Saltzer and Schroeder (1975).

Prompt injection

• Direct and indirect: Liu et al. (2025) formalizes direct injection; the paper states it broke 31 of 36 real LLM applications. Greshake et al. (2023) proposes indirect injection via retrieved content; Zou et al. (2024) reports RAG can serve as a poisoning vector.
• Tool-agent benchmarks: Yi et al. (2025), Zhan et al. (2024), and AgentDojo (Debenedetti et al., 2024) provide evaluations for tool-integrated agents. The paper states these benchmarks measure whether a single agent can be hijacked, whereas this paper studies how an injection propagates through a network after one successful injection.
• Minimal attacker capability: The authors treat indirect injection as a given entry point, not as the object under test itself.

Multi-agent attacks and supply chains

• Propagation: Tian et al. (2023) examines agent-level security; Lee and Tiwari (2024) demonstrates LLM-to-LLM propagation. The paper states Lupinacci et al. (2025) reports 100% compliance with malicious peer requests even when models resist the same direct injection. The paper states the difference from such work is looking at the framework layer rather than the model layer, and writing each channel as a violation of a structural invariant.
• Topology and insider threats: Triedman et al. (2025) frames related failures as confused deputy. Yu et al. (2024)'s NetSafe and He et al. (2025) study topology or communication propagation; Shapira et al. (2026) documents chaotic failure modes; Lynch et al. (2025) examines agents as insider threats.
• Protocols and skills: Hou et al. (2025) and Song et al. (2025) survey MCP; Louck et al. (2025) examines A2A; Li et al. (2025) points out cross-tool harvesting; Schmotz et al. (2026) measures vulnerability to malicious SKILL.md. The paper states it treats injection success as given and studies what happens after the payload enters.

Defenses and existing benchmarks

• Model and prompt layers: Wallace et al. (2024)'s instruction hierarchy is at the model layer. Wang et al. (2025) systematizes prompt-layer defenses such as delimiting and spotlighting; the paper states these defenses can be bypassed.
• System layer: CaMeL (Debenedetti et al., 2025) uses a custom interpreter for capability-based control and data flow; the paper states it achieves 67% provable safety on AgentDojo tasks. Ghosh et al. (2025) proposes a broader framework. Kang et al. (2025) treats memory as an operating system problem; the paper states it does not write isolation as a security invariant. The authors state their capability registry applies the same PDP/PEP pattern to role-to-resource mapping.
• Benchmarks: AgentDojo, ASB (2024), and AgentHarm (2024) evaluate single-agent adversarial robustness or harmful behavior. The paper states they do not evaluate hierarchy integrity, inter-agent authorization, or memory consistency.

Baseline methods and benchmarks/datasets: The paper does not set up comparable attack algorithm baselines, nor does it run experiments on AgentDojo, ASB, or AgentHarm. The comparison targets are the architectural choices of OpenClaw, Hermes, and Agent Zero.

The authors position the paper after a single-point injection succeeds, explaining inheritance, resources, asynchronous state, and termination with explicit structural invariants, and give orchestration-layer defenses not tied to a specific LLM vendor.

The authors use role-based multi-agent networks to characterize the root orchestrator and recursively generatable sub-agents, write memory, resources, and termination as invariants, map implementation deviations to four vulnerability classes, and use the same mechanisms for remediation.

Problem Setting and Formalization

• Network tuple: agent set A, root a0, directed parent-child edges E, roles ρ, capabilities κ, resource universe T and role-to-resource mapping τ, memory mode μ, lifetime λ, interaction mode ι. Relevant capabilities include spawn, kill, delegate, access-memory, communicate, user-interact.
• Structure: Each sub-agent has exactly one parent. The authors state Theorem 1: under this assumption, if every agent is reachable from a0, then (A, E) is an arborescence rooted at a0. Sub-agents are divided by task, such as planning, retrieval, monitoring, tool use, or verification.
• Lifecycle: Memory modes are inherit-full, inherit-partial, agent-agnostic; lifetimes are one-time or persistent; interactions are session-based or task-oriented. Session-based agents can attach multiple task-oriented sub-agents in one session. Direct user interaction requires holding user-interact.
• Three invariants: Termination scope is written as Terminate(a, b) ⇒ kill ∈ κ(a) ∧ ((a, b) ∈ E ∨ a = a₀), meaning holding kill and being a direct parent or the root a0. Resource access is written as Access(b) ⊆ τ(ρ(b)), meaning effective resources must not exceed the role's authorized set. Memory can only be taken as full, a parent-selected subset, or empty according to the mode. The text also states that direct parents and the root orchestrator can terminate their descendants, and default policies can be overridden by per-agent authorization.

Four Structural Violations

• Unrestricted inheritance: In frameworks that copy the full context at generation time, the authors write the effective memory as identical to the parent memory, thereby violating memory isolation when the expected mode is not inherit-full. OpenClaw's sessions_spawn injects AGENTS.md and TOOLS.md and merges parent auth config as a fallback; the authors claim that in practice sub-agents receive the full runtime state including chat history and tool configuration. The authors state that this transmission holds unconditionally for session-based descendants; for task-oriented descendants, it propagates only if contaminated fragments enter the initialization prompt, with narrow prompts forming a partial barrier.
• No resource access control: When call sites do not enforce role-to-resource mapping, effective access includes the framework's exposed surface. OpenClaw by default gives sub-agents all tools except sessions_list, sessions_history, sessions_send, sessions_spawn, including exec, filesystem, web browsing, and installed plugins.
• Asynchronous divergence: Sub-agents get a snapshot of parent memory at generation time, and later parent memory updates are not synchronized. Persistent writes can be session history, or the underlying model may choose SQLite or MEMORY.md on its own; the paper states there is no deterministic policy. The authors claim that even if inheritance is narrowed, the lack of post-generation synchronization can exploit stale context, and the two are orthogonal and stackable.
• Sibling termination: Session-based sub-agents can terminate task-oriented siblings within their own session via natural language instructions. The two have no parent-child edge, and the actor is not a0, violating termination scope. The authors state this requires no separate privilege escalation; termination is the result of the reasoning layer acting on context. Table I lists the consequence as terminating or hijacking sibling sessions; the text states that a compromised agent may also use excessive tool access to take over the responsibilities of a terminated peer.

Defense Mechanisms

• Agent Capability Registry: At generation time, register κ(b) and the resource set by role, where the resource set equals the role's authorized set, and is immutable after registration. kill is only granted to targets when a parent-child edge exists. A parent cannot grant capabilities or resources it does not have. PEP permits or denies at each call. The authors state Theorem 2: resource access is bounded by the registered set, and structural operations must belong to κ(b). Sibling termination is thus blocked by unified checks, regardless of command-driven or instruction-driven.
• Role-based memory projection: Parent memory is divided into segments with sensitivity labels, with an example lattice of public ⊏ task-local ⊏ privileged. At generation time, only segments whose sensitivity is covered by the role are retained. The authors claim that payloads only enter sub-memory if they fall within the sub-role's permissions, and leave the accuracy of write-time labeling as future work.
• Revision log: A shared, append-only log records updates or revocations, controlled by the parent. Sub-agents check whether a context item has been revoked since the snapshot before acting on it. The authors state that after a parent issues a revocation, payloads brought in at generation time become invalid without resynchronizing the entire session, and the log can also serve as an audit trail.
• Correspondence: Table II maps unrestricted inheritance to generation-time projection, missing resource control and sibling termination to the runtime registry, and asynchronous divergence to pre-action validity checks. The authors state that existing work on memory management treats memory as a system problem, while here the emphasis is more on security invariants.

Evaluation Method

• Whether a vulnerability exists is observed by whether behavior violates the corresponding invariant: whether rules that should not be inherited are executed, whether resources outside the role are called, whether submissions still use old snapshots after parent state has changed, and whether unauthorized parties terminate peers.
• The paper provides no numerical thresholds, review models, or automated scoring rules. The model itself does not formalize execution semantics, concurrency, or transport protocols.

Experimental Setup

• Primary platform: OpenClaw 3.13, running in an Ubuntu Desktop 24.04 LTS container; largely default configuration, with command-line tools enabled to extend capabilities. A dedicated Discord server for user-agent communication. The authors state it is one of the most-starred open-source personal agents on GitHub, and its design has been borrowed by subsequent projects.
• Comparison frameworks: Hermes (version not specified in the paper) and Agent Zero M v1.13. They were chosen to compare against architectures that only use task-oriented sub-agents.
• Models: The LLM used for the main PoCs is not specified in the paper. The ablation used five additional vendor models from Table III: MiniMax M2.5, Llama-4-Maverick-17B-128E-Instruct-FP8, Qwen3.5-Plus, DeepSeek-V3.2, GPT-5.2-Codex.
• Objects: The four vulnerability categories were exploited individually. The paper does not attack algorithm baselines, nor does it use AgentDojo, ASB, or AgentHarm.
• Determination: Observation of whether the described violations occurred, including file final states, whether self-start executed, whether sub-agents inherited parent rules, and whether peers were terminated. The paper does not specify the review model, thresholds, sample sizes, or number of repetitions.
• Environment constraints: Experiments were conducted in controlled local VMs or containers; prompts, files, and resources were synthetic, with no connection to real accounts, production services, or external systems. The authors state they reported to the maintainers before public disclosure.

Main Results

Vulnerability	Observation on OpenClaw 3.13	Source
Asynchronous memory divergence	Shared resource initial value SAFE; after completion, verification result file is VERIFIED_SAFE, shared resource is COMPROMISED	Figure 3, Section VI-A
No resource access control	Permission changes, execution, and user-level self-start registration were not blocked; after reboot and login, payload executed automatically	Section VI-B
Unrestricted memory inheritance	Sub-agents assigned unrelated tasks still read and report the updated target file	Figure 4, Section VI-C
Unauthorized sibling termination	A session-type sub-agent terminated a task-type sibling that was still executing	Section VI-D

• The authors state the four issues come from the orchestration layer rather than model behavior, and they compound: inheritance delivers payloads to sub-agents, lack of access control allows them to execute with excessive privileges, asynchronous divergence prevents parent-side remediation from reaching already-generated sub-agents, and sibling termination can remove peer agents that provide oversight (Section V-F, Table I).
• In the divergence PoC, the main agent submits verification based on its own cached view, while the sub-agent independently rewrites the same resource; the framework does not reconcile before both actions are finalized. The authors state that if resources are large or review costs are high, stale VERIFIED_SAFE may continue to be trusted.
• In the inheritance PoC, keyword-triggered rules from the parent session are still executed by sub-agents after file content updates. The authors state that sub-agents silently inherit task rules, file access patterns, and keyword triggers, and inheritance is real-time; combined with lack of access control, malicious prompts can be passed to newly created sub-agents. In the sibling termination PoC, the reporting task runs every 30 minutes, the tracking task updates every 10 seconds for 1 hour, termination occurs mid-execution, and without parent authorization.

Cross-Vendor Ablation

• What was tested: The five models in Table III received the same vulnerability tests as above, to distinguish model behavior from framework design (Section VI-E1).
• Results: The authors state all five models exhibited susceptibility and reproduced the core vulnerability behaviors. The paper does not provide per-model, per-vulnerability success rates.
• Authors' interpretation: The authors attribute this cross-vendor consistency to the structural nature of multi-agent frameworks, rather than common flaws in the underlying models; and state that changing the underlying LLM does not yield meaningful security improvements, with the coordination layer being the primary threat surface to patch.

Framework Architecture Comparison

• What was tested: Agent Zero M v1.13 and Hermes. Neither supports session-type sub-agent generation; they only instantiate in a task-oriented manner (Section VI-E2).
• Results: The authors state that cross-mode sibling termination is therefore not applicable by construction. Memory divergence still occurs: tool outputs, intermediate results, and workspace writes during task execution are not synchronized back to the parent node or peers, and post-generation corrections from the parent do not reach executing sub-agents. Inheritance is narrower than OpenClaw: sub-agents are initialized from role-scoped predefined system prompts rather than full copies; the authors state the transitivity of contamination does not hold unconditionally, which constitutes a partial informal enforcement of memory isolation.
• Authors' interpretation: Neither enforces role-to-resource mapping at invocation time; the authors state that resource access control violations still apply. Compared to OpenClaw, exploitation is harder because the interaction surface is narrower, and Hermes uses keyword checks to request user confirmation before executing critical commands. The authors state these defenses mainly protect OS-level rather than workspace-level assets, still rely on LLM internal guardrails, and shift the security burden to users; the observed security differences mainly come from smaller functional scope, with session-type generation and runtime termination being feature absences rather than access control, and narrowed inheritance being convention rather than enforced policy.

Other Ablations and Analyses

• OpenClaw sub-agents' default tool surface excludes four session tools, but includes exec, filesystem, web browsing, and installed plugins (Section V-C).
• Persistent memory is written to session history, or the model may choose SQLite or MEMORY.md; the paper states there is no deterministic policy (Section V-D).
• The authors state that task-type descendants only inherit payloads when contaminated fragments enter the initialization prompt (Remark 3).
• The authors state that snapshot divergence is not easily detectable as a standalone anomalous event because session memories are not shared (Section VI-A).
• The authors state that sibling termination is more likely to be noticed by the owner because network function disruption is observable, while still being disruptive (Section VI-D).
• The PoC Fixes after each PoC, according to the proposed mechanisms, state that unauthorized calls would be rejected, parent rules could be not projected, non-parent terminations would be blocked, and stale revisions would prevent direct verification submission; the paper does not report interception rates or quantified results after implementation for these fixes (Sections VI, VIII).

Limitations and future directions noted by the authors

• The formal model only covers agent creation and composition; it does not formalize frontend/backend roles, execution concurrency models, or inter-agent communication protocols. The authors state these runtime dimensions may introduce additional attack surfaces, such as races in concurrent delegation or insecure transport, but they are outside the scope of this study. (Section III-F)
• The model mediates resource access and behavioral expectations through roles; it does not cover undifferentiated agents with identical capability sets, nor access control based on identity rather than role. The authors state that extending to attribute-based or identity-based paradigms remains future work. (Section III-F)
• The authors state that LLM probabilisticity creates a major gap between distributed systems and multi-agent systems. Future work should base security as much as possible on deterministic system design while leveraging LLM reasoning capabilities, keeping LLMs operating within constrained system boundaries. (Section VIII)
• The authors state the paper focuses on theoretical modeling, defense design, and the conceptual existence of the identified vulnerabilities, and that the diversity of multi-agent systems requires subsequent research on how these defenses adapt to different scenarios. (Section VIII)

Experimental coverage

• The main PoC was conducted in an OpenClaw 3.13 container on Ubuntu Desktop 24.04 LTS, with command-line tools enabled and a dedicated Discord server for communication; the four vulnerability classes were each exploited separately (Section VI).
• The cross-model portion covers the five models in Table III, and the authors state all reproduced the core vulnerability behavior; the paper does not report success rates by model or vulnerability (Section VI-E1).
• The architecture comparison covers Agent Zero M v1.13 and Hermes. The paper states that since both have only task-oriented sub-agents, cross-mode sibling termination does not apply by construction; memory divergence and the lack of role-to-resource mapping still apply (Section VI-E2).
• The defenses use a capability registry, role-projected memory, and an append-only revision log as mechanism descriptions and PoC fixes. The paper does not report interception rates, latency, or utility changes after implementing these mechanisms.
• The paper does not report the LLM used in the main PoC, the number of repetitions, or the number of queries, nor does it report the Hermes version number.

The authors formally analyze sub-agent inheritance in multi-agent networks and use PoCs on an open-source framework to demonstrate how the orchestration layer allows a single point of compromise to keep spreading.

• Problem: After one agent is compromised, parent memory, tool surface, and termination rights are passed down when generating sub-agents. The authors argue this lets local compromise cross trust boundaries; existing work mostly stops at single-point injection, protocols, or single-agent benchmarks.
• Method: The role-based network specifies a unique parent node, role capabilities, three types of memory inheritance, two lifetimes, and two interaction modes. Termination scope, memory isolation, and resource access are written as invariants. The fixes are an immutable-after-generation Agent Capability Registry, memory projection by sensitivity, and a parent-controlled append-only revision log.
• OpenClaw 3.13: When a shared resource has been changed to COMPROMISED, the main agent still submits VERIFIED_SAFE (Figure 3). A sub-agent for an unrelated task still executes file-reading rules from the parent session (Figure 4). Permission changes, execution, and user-level auto-start are not blocked by the framework, and the payload executes automatically after a reboot and login. A session-based sub-agent terminated a still-running task-based sibling without parent authorization.
• Other settings: All five additional vendor models in Table III reproduce the core vulnerability behavior. The authors state that Agent Zero and Hermes, having only task-based sub-agents, do not exhibit cross-mode termination by construction, and inheritance is also narrower, but memory divergence and the lack of role-to-resource mapping still apply; these differences mainly come from a smaller functional scope.
• Authors' conclusion: The authors state that inheritance is not an implementation detail but a central component affecting multi-agent security. They state that LLM reasoning should be kept as much as possible within deterministic system boundaries, and leave adapting defenses to different scenarios as future work.