Multi-agent AI systems are becoming a standard architecture for enterprise automation. Instead of relying on a single model to handle every task, organizations now chain together specialized agents that plan, retrieve data, call tools, and hand off work to one another. This design improves efficiency, but it also introduces a new category of risk: when one agent is compromised or makes a flawed decision, the damage doesn’t stay contained. It spreads. Security researchers call this the “blast radius” problem, and red teaming has emerged as one of the few reliable ways to measure it before it becomes a real incident.
Firms working in this space, including Noma Security, have started publishing findings that show how quickly a single manipulated input can ripple through an entire agent network. Understanding how that happens, and how testing teams uncover it, is essential for anyone building or deploying agentic AI.
Why Multi-Agent Systems Change the Risk Calculus
A traditional application has predictable boundaries. A user sends a request, a server processes it, and a response comes back. Multi-agent systems don’t work that way. Agents pass instructions to other agents, sometimes across different vendors, models, and permission levels. An agent responsible for summarizing customer emails might trigger another agent that updates a CRM record, which in turn triggers a third agent that sends a follow-up message.
Each handoff is a trust boundary. If one agent accepts a malicious or malformed instruction, through prompt injection, a poisoned data source, or a subtly manipulated tool output, that instruction can propagate downstream without ever being re-validated. Research from Carnegie Mellon and other academic groups studying agent security has found that once an injected instruction crosses into a second agent’s context, most systems have no mechanism to detect that the instruction didn’t originate from a trusted source. The failure isn’t isolated to the entry point; it inherits the permissions and reach of every agent it touches afterward.
This is the core reason blast radius has become a distinct concept from traditional vulnerability scoring. A single flaw’s severity depends less on how it was introduced and more on how far it can travel once inside the system.
What Red Teaming Actually Tests For
AI red teaming, in the multi-agent context, is not the same exercise as traditional penetration testing. Classic red teaming looks for a way in. Agentic red teaming looks for a way through, tracing how a compromise at one point in the chain affects every agent and system connected to it.
A structured red teaming exercise for multi-agent architectures typically covers:
- Injection propagation — testing whether a manipulated input at one agent survives being passed to downstream agents without re-sanitization
- Privilege inheritance — checking whether a lower-trust agent can indirectly trigger actions reserved for higher-trust agents
- Tool and API misuse — probing whether an agent can be tricked into calling external tools outside its intended scope
- Memory and context poisoning — determining if false information injected early in a session persists and influences later decisions
- Cross-agent data leakage — verifying whether sensitive data retrieved by one agent surfaces in outputs generated by an unrelated agent
Red teaming approaches developed by Noma Security and other AI security teams examine how prompt injection, memory manipulation, tool misuse, and related attack techniques can affect authenticated sessions, multi-step agent workflows, and real data flows. The value of this kind of testing isn’t in finding one isolated bug. It’s in mapping the full path a failure can take and understanding how an initial compromise could influence later actions across connected systems.
How Blast Radius Is Measured in Practice
Unlike a conventional vulnerability, blast radius doesn’t have a single severity score. It’s assessed by mapping the system’s trust graph — which agents can call which tools, which agents share memory or context, and which have write access to production systems — and then simulating a compromise at each node to see how far it spreads.
Teams conducting this kind of assessment generally look at three variables:
- Depth — how many agent-to-agent handoffs an injected instruction can survive before being caught or neutralized
- Breadth — how many separate systems, tools, or data stores become reachable once the first agent is compromised
- Persistence — whether the malicious instruction or false context remains active across multiple sessions rather than expiring with the original interaction
A 2024 study on agentic workflows found that in loosely governed multi-agent deployments, an injected instruction could reach an average of three to four downstream agents before any validation step intervened, and in a meaningful share of test cases, it reached a tool with write access to an external system. That gap between where a flaw enters and where it can act is precisely what red teaming exercises are designed to expose. Noma Security’s public research has echoed this pattern, noting that agent-to-agent trust is often assumed rather than verified, which is exactly the assumption attackers exploit.
The Role of Governance Alongside Testing
Red teaming identifies where the risk lives, but it doesn’t eliminate it on its own. Reducing blast radius requires architectural changes: segmenting agent permissions, requiring re-validation at each handoff, limiting how long context persists, and logging cross-agent actions so that anomalies can be traced back to their origin. Security teams that treat red teaming as a one-time audit rather than a recurring practice tend to miss new blast radius paths that open up as agent workflows are updated or expanded — a point Noma Security and other researchers in this field have repeatedly emphasized in their published assessments.
What We’ve Learned
Multi-agent AI systems offer real efficiency gains, but they also collapse the boundaries that used to contain individual failures. A single manipulated input no longer has to defeat one system — it only has to find one weak handoff among many. Red teaming, done properly, doesn’t just look for that first weak point. It traces the full path a compromise can take, measuring depth, breadth, and persistence across the entire agent network. As organizations like Noma Security continue to study these failure patterns, the emerging consensus is consistent: in agentic systems, the size of the blast radius often matters more than the nature of the original flaw.
