Multi-agent systems may not need fundamentally new monitors....the bigger problem is whether monitors are given enough information to see the attack.
Multi-agent settings have exposed multiple gaps in the current monitoring enviroment. Several recent works have exposed the need for these systems. A main worry is that this oversight only gets worse as we scale up from multi-agent setups (MAS) to agent swarms.
Current monitoring efforts often use an LLM as a judge to decide whether an agent is engaging in malicious activity. These approaches have achieved good performance against malicious agents. As the monitor is given more information about the agent, from just tool calls (action-only) to its reasoning and chain-of-thought (CoT); monitoring performance generally improves, assuming that the agent is honest in what it reports.
However, the recent OpenAI attack (CITE) in many ways exposes the limitations of these systems. As we scale from single-agent systems to multi-agent systems (MAS), the potential attack surface increases. A worrying trend in recent research exploring relatively small MAS setups (typically fewer than 10 agents) is that monitoring performance does not seem to keep up, at least with the way we monitor these systems today.
This leaves us with a fundamental question: do multi-agent systems require a completely different monitoring paradigm, or are current monitors simply not being given enough information to capture the sabotage in full?
In my opinion, in this game, we have three axes along which make or break the success of control.
This framing assumes that the attacker is reasonably honest about its observable actions, such as tool calls and outputs. Where chain-of-thought is available, it may provide additional signal, but I do not want the argument here to depend on faithful CoT reporting. The reason for this is that many studies often study an upperbound on these types of attacks/evasion. This means that the provided prompts often tell the attacker agent that it has to commit the full or part of the sabotage which makes its CoT by default incriminating.
For a single-agent adversary, these three axes can often be bridged reasonably well, and existing monitoring work has made significant progress on this. In multi-agent systems, however, the latter two become substantially more problematic since in practice we typically have a separate monitor for each agent within the MAS.
These problems stem from (1) the way these systems are deployed in practice and (2) the plausible attack surfaces these MAS expose.
In realistic deployments, each sub-agent in a MAS may operate within its own container or endpoint. There is often no default reason for the full trajectories of every sub-agent to be collected and presented together to a single monitor. If the relevant evidence for sabotage is distributed across these trajectories, then an individually monitored agent may look completely benign even when the system as a whole is carrying out a malicious objective.
Importantly, this fragmentation need not even be deliberate. Agents may simply carry out different pieces of a larger task without any individual agent understanding the full extent of what the system is doing. Alternatively, an adversarial MAS could deliberately exploit this structure, distributing a malicious objective across agents precisely because each local action appears benign.
The latter case, deliberate exploitation of multi-agent structure as an attack surface, is interesting in its own right, and I explore it in the sections below.
Vartak, Rohit (Oct 2026). Position: Monitor the system, not the agents. https://Rohit01-zoey.github.io/blog/2026/position-monitoring/.
or as a BibTeX entry:
@article{vartak2026position-monitor-the-system-not-the-agents,
title = {Position: Monitor the system, not the agents},
author = {Vartak, Rohit},
year = {2026},
month = {Oct},
url = {https://Rohit01-zoey.github.io/blog/2026/position-monitoring/}
}
Here are some more articles you might like to read next: