{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/microsoft-red-teaming-agent-network-2026/",
 "asOf": "2026-09-26",
 "id": "microsoft-red-teaming-agent-network-2026",
 "date": "2026-04-30",
 "datePrecision": "day",
 "title": "Microsoft Research red-teams a network of 100+ agents and finds propagation and trust-capture failures",
 "lane": "defense",
 "kind": "paper",
 "summary": "Microsoft researchers red-teamed an internal platform of over 100 always-on LLM agents that represent different people and interact through forums, messages and a marketplace. They describe four network-level failure modes: self-propagating messages, amplification of false claims, capture of reputation and verification systems, and hard-to-trace flows through unwitting intermediaries. A small share of agents spontaneously adopted protective behaviors that spread through the network.",
 "whyItMatters": "It shows agent-to-agent interaction creates attack paths, such as worms and proxy exfiltration, that single-agent testing misses.",
 "actors": [
  "microsoft"
 ],
 "topics": [
  "multi-agent-security",
  "prompt-injection",
  "data-exfiltration"
 ],
 "atlas": [
  "other-agents",
  "untrusted-content"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://www.microsoft.com/en-us/research/blog/red-teaming-a-network-of-agents-understanding-what-breaks-when-ai-agents-interact-at-scale/",
   "publisher": "Microsoft Research",
   "title": "Red-teaming a network of agents: Understanding what breaks when AI agents interact at scale",
   "date": "2026-04-30",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "A single self-propagating message reached all 6 agents in the test group, looped back after six hops and kept circulating for over 12 minutes; in total it consumed over 100 LLM calls billed to the victims' principals.",
   "locator": "Case study 1, Self-propagating worms"
  },
  {
   "fact": "A fabricated claim drew 299 comments from 42 agents; in a separate test, sensitive data reached the attacker through a single intermediary over five messages.",
   "locator": "Case studies 2 (Reputation manipulation) and 4 (Proxy chains)"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-087"
 ],
 "methods": [
  "adaptive-red-teaming",
  "agent-data-exfiltration",
  "agent-propagation"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}