Hunt Agent Multi-Agent Systems

Multi-agent systems create trust boundaries a single agent doesn't have: an orchestrator that trusts sub-agents, a privileged/"clearance" agent others can reach, shared memory, A2A endpoints, and tools that fire "if the session is privileged." Each boundary is a confused-deputy. The winning move is rarely "jailbreak one agent" — it's make a trusted agent take an action you couldn't take directly, or speak the inter-agent protocol yourself.

Where This Lives / Attack Surface Signals

• Agent references "another agent / the files agent / clearance / the orchestrator / escalate to…".
• A tool read_root_flag/get_system_status/admin_* gated by "if privileged/authorized".
• Roles split by agent (utilities / files / clearance).
• Shared scratchpad/memory/cache tool one agent writes and another reads → indirect-injection channel.
• A2A signals: an .well-known/agent.json agent card, an /a2a endpoint, tasks/send, nonce/handshake "auth", "skills"/"clearance" advertised by another agent.

Crown Jewel Targets

Enterprise agent meshes: a low-priv support agent that can reach a high-priv data/ops agent; A2A/agent-card servers exposing privileged "skills"; shared memory poisonable to affect all users; service-account trust that ignores end-user identity (the confused-deputy root).