Multi-agent systems delegate subtasks to specialized sub-agents. If a sub-agent is compromised — either by an attacker taking over its deployment, or because it was built with its own vulnerabilities — its outputs enter the orchestrating agent's context as trusted data.

The orchestrating agent treats a sub-agent's output the same way it treats its own reasoning. A compromised sub-agent can inject false information, manipulate the orchestrator's decisions, or plant hidden instructions that propagate through the pipeline.

Real example: AgentSmith Prompt-Hub Proxy Attack (Scenario 4) — a compromised proxy layer between agents exfiltrated data from every request that passed through it.

MCP servers and package registries are shared infrastructure. A single compromised registry doesn't affect one agent — it affects every agent that trusts that source. Attackers who can push to a widely-used registry or hijack a popular MCP server get immediate scale: every download, every connection, every agent that uses the server becomes a victim simultaneously.

Real example: The Amazon Q VS Code extension incident (v1.84.0) — a compromised update channel pushed a malicious version that exfiltrated API keys and tokens from developers using the extension.

Agents that use retrieval-augmented generation pull context from external knowledge bases at query time. If an attacker can seed entries into that knowledge base — or compromise the indexing pipeline that builds it — they can influence what context the agent retrieves and uses.

This is the slowest and most insidious attack type. Individual poisoned entries look like legitimate data. The bias accumulates gradually. By the time the effect is noticed, hundreds or thousands of responses may have been shaped by the attacker's planted content.

Type 6 (Agent-in-the-Middle via Agent Cards) is covered in Scenario 6.