One poisoned worker description drops multi-agent GAIA success from 84.31% to 37.25% without ever being invoked.

In centralized multi-agent systems the planner reads third-party worker descriptions and trusts them at registration, before any user instruction exists (arXiv 2609.15516). Across 32,000 descriptions from three public agent marketplaces, most omit input specs and usage constraints, and at least 23.35% contain content outside the four defined fields. Eight manipulation strategies cut task success to 37.25% at worst, or raised tokens and execution time over 111%. The crafted worker takes effect even when it never gets a subtask.