多智能体人工智能系统或MAS是自主代理系统，通过委托工具权限、共享持久内存和通过代理间通信协调。MAS引入了与单个AI模型不同的安全漏洞。现有安全和治理框架未针对这些新兴攻击面进行设计。本文系统地描述了MAS的威胁景观，并定量评估了16个AI安全框架。提出四阶段方法：构建生产多智能体架构的深度技术知识库；利用生成式AI辅助进行针对MAS网络安全风险的威胁建模，并由领域专家验证；在个体威胁粒度上制定调查计划；并根据网络安全风险对每个框架进行评分。风险被组织成193个不同的主要威胁项，跨越九个风险类别。预期的最小平均得分为2。没有审查的框架在任何单一类别中实现多数覆盖。非确定性（在16个框架中平均得分为1.231）和数据泄露（1.340）是最未被解决的领域。OWASP Agentic Security Initiative在整体覆盖率达到65.3%并在设计阶段领先；CDAO Generative AI Responsible AI Toolkit在开发和运营覆盖方面领先。这些结果提供了多智能体系统安全的首次实证跨框架比较，并为框架选择提供了基于证据的指导。请查看已发表期刊版本的信息。
英文摘要：
Multi-agent artificial intelligence systems or MAS are systems of autonomous agents that exercise delegated tool authority, share persistent memory, and coordinate via inter-agent communication. MAS introduces qualitatively distinct security vulnerabilities from those documented for singular AI models. Existing security and governance frameworks were not designed for these emerging attack surfaces. This study systematically characterizes the threat landscape of MAS and quantitatively evaluates 16 security frameworks for AI against it. A four-phase methodology is proposed: constructing a deep technical knowledge base of production multi-agent architectures; conducting generative AI-assisted threat modeling scoped to MAS cybersecurity risks and validated by domain experts; structuring survey plans at individual-threat granularity; and scoring each framework on a three-point scale against the cybersecurity risks. The risks were organized into 193 distinct main threat items across nine risk categories. The expected minimal average score is 2. No reviewed framework achieves majority coverage of any single category. Non-Determinism (mean score 1.231 across all 16 frameworks) and Data Leakage (1.340) are the most under-addressed domains. The OWASP Agentic Security Initiative leads overall at 65.3\% coverage and in the design phase; the CDAO Generative AI Responsible AI Toolkit leads in development and operational coverage. These results provide the first empirical cross-framework comparison for MAS security and offer evidence-based guidance for framework selection. Please check back for information on the published journal version.
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
Oxford Witt Lab, University of Oxford（牛津Witt实验室，牛津大学）；Department of Engineering Science, University of Oxford（牛津大学工程科学系）；Association for Computing Machinery (ACM)（计算机协会（ACM））；Independent（独立）；MATS Research（MATS研究）；CyLab Security & Privacy Institute, Carnegie Mellon University（CyLab安全与隐私研究所，卡内基梅隆大学）；Qualcomm Inc.（高通公司）；Oxford Martin AI Governance Initiative（牛津马丁人工智能治理倡议）；Carnegie Mellon University（卡内基梅隆大学）；MIT Media Lab（麻省理工媒体实验室）；SAP SE（SAP德国分公司）；OWASP GenAI Security Project - Agentic Security Initiative（OWASP生成式AI安全项目-代理安全倡议）；Contramont Research（Contramont研究）；The Alan Turing Institute（艾伦·图灵研究所）；Department of Economics, New York University（纽约大学经济系）；Zenity（Zenity公司）；King’s College London（伦敦国王学院）；Arizona State University（亚利桑那州立大学）；Torr Vision Group, University of Oxford（托尔视觉组，牛津大学）；Deep Cyber Ltd（Deep Cyber有限公司）
A Knowledge-Based Multi-Agent Framework for Security Control Recommendation
Cybersecurity & Blockchain Research Group, i2CAT Foundation（网络安全与区块链研究组，i2CAT基金会）；Department of Information and Communication Technologies, Universitat Pompeu Fabra（信息与通信技术系，庞培法华大学）
A Security Analysis of Long-Horizon Agentic AI Systems: Threats, Evaluation, and Framework Development
Department of Computer Science, College of Computers and Information Technology, Taif University, KSA (Summer 2026)（计算机科学系，计算机与信息科技学院，泰夫大学，沙特阿拉伯（2026年夏季））
LLM agents security duality: a comprehensive survey of self-security and empowered cybersecurity
School of Cyber Science and Engineering, Wuhan University（武汉大学计算机科学与工程学院）；Department of Computer Science and Engineering, University at Buffalo（布法罗大学计算机科学与工程系）
Department of Computer Science and Engineering, Southern University of Science and Technology（南方科技大学计算机科学与工程系）；Department of Computer Science and Engineering, Hong Kong University of Science and Technology（香港科技大学计算机科学与工程系）；Southern University of Science and Technology（南方科技大学）；Hong Kong University of Science and Technology（香港科技大学）
Measuring Security Without Fooling Ourselves: Why Benchmarking Agents Is Hard
ELLIS Institute Tübingen & MPI-IS & Tübingen AI Center（图宾根ELLIS研究所及MPI-IS与图宾根人工智能中心）；The Alan Turing Institute（艾伦·图灵研究所）；BIFOLD & Technische Universität Berlin（BIFOLD与柏林技术大学）；Technische Universität Darmstadt（达姆施塔特技术大学）
SkillTester: Benchmarking Utility and Security of Agent Skills
Key Laboratory of High Confidence Software Technologies, Ministry of Education, Peking University（高可信软件技术教育部重点实验室（北京大学））；Northwestern Polytechnical University（西北工业大学）
Google（谷歌）；University of California San Diego（加州大学圣地亚哥分校）；University of Wisconsin–Madison（威斯康星大学麦迪逊分校）；EmbraceTheRed；Gray Swan AI；Cornell University（康奈尔大学）
SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents
The Hong Kong University of Science and Technology（香港科技大学）；Ant Digital Technologies, Ant Group（蚂蚁集团数字技术部）；Xi’an Jiaotong University（西安交通大学）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；University of Oxford（牛津大学）；City University of Hong Kong（香港城市大学）；Institute of Science Tokyo（东京科学研究所）；Zhejiang University（浙江大学）；Massachusetts Institute of Technology（麻省理工学院）；University of North Carolina at Chapel Hill（北卡罗来纳大学教堂山分校）；Beijing University of Technology（北京理工大学）
What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；AI Sec Lab, Beijing Chaitin Technology Co.,Ltd（北京柴坦科技有限公司AI安全实验室）
Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study
School of Artificial Intelligence and Computer Science, Nantong University（人工智能与计算机科学学院，南通大学）；State Key Lab. for Novel Software Technology, Nanjing University（新型软件技术国家重点实验室，南京大学）
