How do you red team a multi-agent workflow?

Attack the seams, not the agents. In a multi-agent system the individually hardened components are rarely the weak point. The seams are:

• Inter-agent messages

• Shared memory or state

• The delegation and trust chain

• Tool results flowing back into context

• The orchestrator's own prompt

• The human approval step

Privilege escalation across hops is the objective worth testing, because it is the failure that does not exist in single-agent systems.

Start by mapping trust. Which agent accepts input from which, what each one can reach, and whether a downstream agent treats an upstream agent's output as trusted. It almost always does, and that assumption is the vulnerability: an agent with low privilege that can influence a high-privilege agent's context has effectively borrowed its permissions.

Then inject at each seam and measure whether the instruction survives the hop. A payload planted in a document read by a research agent, surfacing in a summary passed to an execution agent, is the canonical multi-agent attack and it defeats input filtering at every stage because the content is always arriving from a trusted internal source.

Test shared memory separately. A poisoned entry written by one agent and read by another later decouples the injection from its effect, which breaks most detection built on session-scoped analysis. Test the approval step adversarially, including approval fatigue and requests crafted to look routine. Instrument full trajectories or you will not be able to tell where the escalation happened.

Akto's red teaming operates at trajectory level across agent workflows, which is what makes cross-agent escalation observable rather than inferred from an outcome.

Harden the agents. Then attack what runs between them.