DeepMind paper: agent cluster breaks about 99% of scenarios for Kimi K3 and two other models under the full budget
DeepMind's Agent Swarm Breaks Kimi K3, GLM-5.3 and DeepSeek in 99% of Injection Tests
A Google DeepMind paper dated November 9 proposes a multi-agent attacker called Agentic Optimizer, which uses 8 two-person squads collaborating through a shared whiteboard to search for injection payloads, causing Kimi K3, GLM-5.3 and DeepSeek V4.1 Flash to block only 1% of attacks under a 320-query budget. The test includes 100 synthetic scenarios and 249 tools; the attack goal is to make the agent execute a tool call unrelated to the user's task but harmless in itself, and it counts as a success only if the tool name, parameter keys and values match exactly. The strongest defender, Gemini 4 Argon, blocked 87% when the attacker had 150 queries, dropping to 66% when the budget rose to 320; Gemini 3.8 Flash dropped from 34% to 10%. Under 80 AgentDojo scenarios and a 25-query budget, the cluster broke 6, compared with 2 for the previous best open-source attacker, Prompt Siren.
The paper shows that the same defender model's resistance drops from 87% to 66% against a stronger attacker, and the robustness score depends on the attacker used to test it.