New Study Separates Local Multi-Agent Vulnerabilities from Final Consequences: Finance Task Defense Cuts Attack Success to 53.8%

In multi-agent systems, although local protocol attack success rates often exceed 90%, the conversion into actual negative consequences ranges only from 7.1% to 100.0%. This finding comes from a newly released preprint introducing Agent-Canary-Mas, an evaluation system designed to address the disconnect between "local protocol attack success" and "final task consequences," indicating that intermediate agent decisions can either block or amplify risks.

Traditional security assessments often measure only the exploitability of individual nodes, failing to identify which participant caused the final erroneous decision. Agent-Canary-Mas tracks full-chain evidence—from message consumption and tool calls to task state changes—by running 975 matched malicious-benign task pairs across A2A, ANP, and BCS protocols. This method raises the macro-averaged Audit-F1 score from 29.7% to 95.5%, significantly improving risk attribution accuracy.

In specific tests on finance tasks, researchers introduced a "Protocol-context Guard" that checks object authority. The results show this mechanism lowered the average Attack Success Rate (ASR) from 86.1% to 53.8% and the Privilege Escalation Conversion Rate (PTCR) from 65.5% to 31.2%, albeit with a measurable tradeoff in task completion rates.

These results were self-tested by the authors under three model conditions within the OpenClaw framework and have not yet been independently reproduced. The study focuses on simulated protocol interaction risks, leaving its applicability to complex heterogeneous agent systems in real production environments unverified.