Red-Teaming Multi-Agent Attacks for Loss-of-Control Risks

[arXiv] John Kitaoka, Thao Amelia Pham, Carlos Rafael Giudice, and Jacob Merizian have published a paper on arXiv introducing MiniLab, a synthetic environment composed of 5 interconnected services, 249 benign tasks, and 8 attack goals, for studying the loss-of-control risks posed by multiple AI agents colluding covertly; the environment is adapted from internal AI deployment infrastructure. The authors demonstrate "distributed attacks" in which different agents each carry out a fragment of the attack, covering 16 manually optimized attacks including weight exfiltration, unwitting deployment without monitoring, and privilege escalation. The paper states that when the frontier monitoring model GPT-5.6 Sol reviewed each agent's trajectory one by one, it flagged only 7% of successful distributed attacks, whereas the flagging rate was 87% when the same incidental task was performed by a single agent. In tests where models planned attacks themselves, even with execution and monitoring feedback, the best model-planned attacks achieved a covert success rate against single-trajectory monitoring of at most 25%, compared with 80% for manually designed schemes.