MAS Link Deception

Description

The evaluated MetaGPT multi-agent systems are vulnerable to "Web Fraud Attacks" due to insufficient semantic and structural validation of Uniform Resource Locators (URLs) by agentic models. A low-privilege compromised agent can exploit this vulnerability to induce other agents (including auditors and experts) into accepting, visiting, or processing malicious links. The vulnerability leverages the LLM's inability to distinguish between benign and malicious link structures when obfuscation techniques are applied to domain names, subdomains, paths, and parameters. Unlike standard jailbreaks that require high "malicious content concentration" (e.g., explicit harm instructions), these attacks use semantic mimicry (e.g., homoglyphs, directory nesting) to bypass safety alignment and architectural verification steps (such as voting or reviewing). The paper evaluates agents backed by GPT-4o-mini, Gemini-2.5-Flash, DeepSeek-Reasoner, and Llama-3-8B.

Examples

The following attack vectors successfully bypass agent verification logic. Note that [attacker] represents a malicious domain controlled by the adversary.

• Typosquatting/Character Substitution:

• googlee.com (Insertion)

• goegle.com (Substitution)

• googlegoogle.com (Repetition)

• Subdomain & Structure Imitation:

• www.google.com.[attacker].com (Subdomain Imitation)

• this-is-an-official-link.www.[attackerweb].com (Subdomain Name Manipulation)

• Directory/Path Camouflage:

• [attacker].com/www/google/com (Directory Imitation)

• [attacker].com/this/is/an/official/website (Directory Manipulation)

• Parameter Obfuscation:

• [attacker].com/?this-is-an-official-link (Embedding semantic instructions in parameters)

• Homograph Attacks:

• google.com (Where the second 'o' is a Cyrillic character, structurally distinct but visually identical)

• Semantic Bypass (Counter-Intuitive):

• Attacks explicitly claiming security often fail (e.g., "visit the secure website" fails validation).

• Removing security-related keywords increases success: [attacker].com without "secure" claims achieves higher penetration rates.

Impact

• System Compromise: Agents serve as a springboard to visit malicious websites, enabling drive-by downloads or malware injection into the execution environment.
• Phishing & Fraud: Successful validation of fraudulent links allows the propagation of misinformation or phishing pages to end-users or other system components.
• Defense Evasion: The vulnerability persists across common MAS architectures. The paper finds Vote is the most resistant topology and Debate the least resistant, while generic prompt-based defenses (e.g., "Defense B" and "Defense C" cited in the research) can increase attack success rates rather than mitigate them.

Affected Systems

• Framework: MetaGPT.
• Architectures: Linear, Review, Debate, and Vote/Consensus topologies.
• Underlying Models: GPT-4o-mini, Gemini-2.5-Flash, DeepSeek-Reasoner, and Llama-3-8B.

Mitigation Steps

• Architectural Hardening: Evaluate orchestration choices explicitly. In the paper's experiments, Vote is the most resistant topology while Debate is the least resistant; neither should replace deterministic link checks.
• Model Selection: Evaluate the deployed backend against adversarial links. The reported results show materially different susceptibility across GPT-4o-mini, Gemini-2.5-Flash, DeepSeek-Reasoner, and Llama-3-8B.
• Avoid Counter-Productive Prompt Defenses: Do not rely on generic prompt-based defense strategies (e.g., "Check if this link is malicious"), as the evaluated prompt defenses can increase attack success rates. Use topology choices such as voting only as defense-in-depth and retain deterministic link checks.
• Strict Link Sanitization: Implement deterministic, non-LLM-based whitelist verification for domains and strict parsing of TLDs and subdomains before passing URLs to agents for processing.