Multi-Agent Security: Hardening the Vulnerable Pipeline

A single agent has one trust boundary: the model. A multi-agent pipeline has many, and each handoff — worker to worker, worker to supervisor, tool to agent — is a place where attacker-controlled text can be promoted into an instruction. Research such as arXiv 2608.00718 documents how these flaws compound: an injected string in a fetched web page becomes a planner directive two hops later. The fix is to treat every agent boundary like a network boundary: validate inputs, constrain outputs to a typed schema, and never let one agent's raw text become another agent's trusted command. Smoke Monkey Harness makes those boundaries explicit, and Smoke Monkey Canvas lets you inspect them visually.

The most secure topology is a deterministic supervisor: one planner that emits a fixed, typed plan, and workers that cannot invent new routes. A freeform group chat looks flexible but lets any message redefine the goal. Equally important is subcontext isolation — each worker gets its own context window, so a poisoned worker cannot write into the shared memory the others read. Combining fixed routing with isolated memory contains a breach to a single worker instead of the whole swarm. In Smoke Monkey Canvas you can draw those boundaries explicitly and watch a worker get isolated the moment it misbehaves.

A verification agent is a worker whose only job is to check another worker. It reads the proposed change, runs the tests, and returns an independent verdict — so a hallucinated or adversarial edit never reaches your repository unchecked. In Smoke Monkey this is a first-class pattern: the supervisor wires a builder agent to a verifier agent, and the verifier gates the result through the automated test verification loop. Because the harness is deterministic and resumable, the verification step is reproducible, not a hopeful second opinion. A verifier is just another card on Smoke Monkey Canvas, so you can see its verdict next to the change.

Security you cannot see is security you cannot operate. Smoke Monkey Canvas (npx @smoke-monkey/canvas start) renders the whole pipeline as an infinite canvas of connected agent cards, so when a worker returns something suspicious you can trace the exact handoff, pause the offending agent, and open it for review. With 300+ MCP tools wired in and inline approval gates, a supervisor can halt a swarm mid-run the moment a boundary check fails. That live, spatial observability — built on the same harness — is what turns multi-agent security from a theory into an operational control. See also agent security sandboxing and prevent infinite agent loops. Underneath it all, Smoke Monkey Harness supplies the deterministic routing and boundary checks.