Why the coordination layer is the real attack surface

A model can pass every red-team prompt and still hand an attacker the system the moment it joins a multi-agent workflow. Safety properties that hold for one agent do not automatically compose when agents delegate authority, call shared tools, and trust each other’s output. This is the thesis MASec Lab works from: the boundary is no longer the model, it is the protocol traffic between agents and the authority that flows across it.

When OWASP published the first Top 10 for Agentic Applications in December 2025, it made that shift official. The LLM Top 10 covers what a model generates. The Agentic Top 10 covers what an agent does — accessing APIs, modifying data, sending mail, delegating to other agents. Half of its ten risk classes do not exist at all for a single isolated model. They are properties of the coordination layer.

Where single-agent safety stops composing

Three of the ASI classes are coordination failures by definition:

• ASI07 — Insecure Inter-Agent Communication. A perfectly aligned agent that accepts an unsigned agent card, or trusts a self-declared identity on the wire, has been compromised by the channel, not by its own reasoning.
• ASI08 — Cascading Agent Failures. One hallucinated fact, accepted by a trusting downstream agent, compounds at every delegation hop. No single agent did anything wrong; the topology amplified a small error into a systemic one.
• ASI01 — Agent Goal Hijack. An injected instruction redirects an agent’s objective while its output stays fluent. The model is still “behaving” — it is simply behaving toward someone else’s goal.

In each case the unit of failure is not the agent. It is the relationship between agents: who they trust, what they delegate, and how authority moves.

Two questions the coordination layer has to answer

Reduce it to fundamentals and every coordination attack is a failure to answer one of two questions:

1. Is this agent allowed to do what it is asking to do? Authority in most 2026 deployments is self-declared — asserted in a prompt or an unsigned card, with the receiving agent left to make the authorization call alone. That is the gap HCAP targets: attenuable, multi-hop capabilities with provenance, so authority can be verified down a delegation chain instead of assumed.

2. Is this agent acting the way it normally does? Agents are non-deterministic, so signature checks have nothing stable to match. ABFP baselines an agent by the shape of its behaviour — tool sequences, plan structure, timing, access surface — and surfaces hijack, drift, and impersonation as deviations from that baseline.

The two are complementary. An agent that is authorised but behaving anomalously, or behaving normally but reaching past its capability, fails the same audit from opposite directions.

What this means for testing

Agentic pentest tools point a swarm of agents at an ordinary app. LLM red-teaming probes a single model. The risk that the Agentic Top 10 codifies lives in neither place — it lives in between, where agents trust, delegate, and act together. Testing it means treating the protocol traffic and the delegation graph as first-class targets, and mapping what you find to a taxonomy others recognise.

That is the whole remit of MASec Lab. More to follow — protocol-level findings, ABFP baselines, and walkthroughs of the OWASP Agentic Top 10 class by class.