trailofbits/pajaMAS

Demonstrates control-flow exploitation attacks across six scenarios—from basic orchestrator hijacking and malicious tools to persistent memory poisoning and unintended agent cycles—using LLM-based multi-agent systems built with Anthropic's API. Attacks manipulate inter-agent communication and workflows by injecting malicious prompts into web content, tool responses, and agent memory, exposing how MAS architectures amplify existing agentic AI vulnerabilities. Includes a naive defense example to illustrate ineffective guardrails against these novel attack vectors.