feat(multiagent): Sprint 22 — inter-agent / Agent-in-the-Middle attack battery (v1.12.0) - #14
Merged
Merged
Conversation
…k battery (v1.12.0) A fresh Discovery sweep showed the 2026 frontier has moved past single-agent attacks (toki.agentic) to multi-agent systems: the inter-agent message channel is the new attack surface. An adversarial Agent-in-the-Middle intercepts, tampers with, or spoofs agent-to-agent messages so a downstream agent acts on attacker content believing it came from a trusted peer (OWASP ASI 2026; arXiv 2510.06445 / 2510.26037). - toki.multiagent: MultiAgentAttackType (8 inter-agent threats) + OWASP_ASI mapping; MultiAgentBattery (32 deterministic cases, 4/type) modelling a MITM on an agent pipeline; MultiAgentEvaluator scoring whether the downstream agent acted on tampered content vs held to provenance; MultiAgentScenario/Verdict - toki.coverage: new "multiagent" category axis (critical), routed without misrouting to agentic/multiturn - CLI: python -m toki multiagent [--type] [--json] - toki.__init__ exports; version 1.11.0 -> 1.12.0; pyproject bumped - 19 new tests (16 module + 3 CLI); 763/763 passing; module 100% covered Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRE1YLhT6aNP4GZT8zbw6q
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sprint 22 — Multi-Agent / Inter-Agent Attack Battery (v1.12.0)
Motivation
A fresh Konjo Discovery sweep (run after the P3 backlog was cleared) showed the 2026 frontier has moved past single-agent attacks (which
toki.agenticalready covers) to multi-agent systems. The inter-agent message channel is the new attack surface: an adversarial Agent-in-the-Middle intercepts, tampers with, or spoofs agent-to-agent messages so a downstream agent acts on attacker content believing it came from a trusted peer (OWASP ASI 2026 insecure inter-agent comms; arXiv 2510.06445, SIRAJ 2510.26037). toki had nothing for multi-agent topologies.What's new —
toki.multiagent(zero external deps)MultiAgentAttackType(8): message tampering / interception, identity spoofing, instruction injection, goal-hijacking relay, memory-relay poisoning, trust exploitation, capability escalation — each mapped to an OWASP ASI 2026 categoryMultiAgentScenario/MultiAgentVerdict(frozen) — agenttopology,senderprovenance,originalvstamperedmessage, deterministic SHA-256 seedMultiAgentBattery— 32 deterministic cases (4/type) modelling a MITM on one channel of an agent pipelineMultiAgentEvaluator— flags whether the downstream agent acted on tampered content or held to provenance/policyIntegration
toki.coverage— newmultiagentcategory axis (critical), routed without misrouting toagentic/multiturnpython -m toki multiagent [--type all|<name>] [--json]toki.__init__exports +__version__→1.12.0;pyproject.tomlbumpedLive demo
The battery against a mock safe downstream agent (verifies sender provenance) blocks all 32 attacks → ASR 0%, mean score 1.0; echoing the tampered message back yields ASR > 0 across every type.
Verification
toki.multiagent100% coveredruff check/formatclean on new files; vulture clean; all functions ≤ grade B;cargo testgreen🤖 Generated with Claude Code
https://claude.ai/code/session_01WRE1YLhT6aNP4GZT8zbw6q
Generated by Claude Code