0.000 Attack Success Score Was Mostly Azure's Filter, Not the Agent

Hossain and coauthors ran an undefended planner, worker, verifier, synthesizer agent system through 2,100 traces across eight attack families, five defenses, and three model backends. It reported a 0.000 attack success rate on tool- and memory-poisoning attempts, which sounds like a solved problem. It wasn't. Of the system's 60 blocks, 54 came from Azure GPT-5's server-side content filter sitting in front of the model, not from anything in the agent's own logic. Swap in a backend without that filter and safety fell back on whatever alignment the underlying model happened to have.

That's the kind of result that should worry anyone shipping a multi-agent system and pointing to a benchmark score as proof it's safe. If your defense is actually your cloud provider's content filter, you don't have a defense, you have a dependency, and it disappears the moment you switch models or providers.

The authors' fix, ChannelGuard, adds embedding-similarity gates at every hop between agents, no extra LLM call required. It blocked all 30 tool-poisoning attempts identically across Azure GPT-5, Sonnet 4.5, and Haiku 4.5, cut prompt-injection success from 0.333 to 0.167, and held GSM8K accuracy at 0.867. That consistency across backends is the actual point: a defense that performs the same regardless of which model sits behind it is measuring something real.

What it doesn't solve

The authors are upfront that white-box adaptive paraphrase attacks evade every embedding gate they tested. This is a floor, not a ceiling, and it's an inter-agent hop defense, not a full answer to the identity and authorization gaps showing up in related agent-security research. The whole study cost $47.36 to run, which matters mainly because it removes any excuse for skipping backend-swap testing before trusting a benchmark number.