Agentic Workflow Pattern Attacks

Overview of attacks targeting common agentic workflow patterns including sequential, parallel, and hierarchical execution, covering how workflow structure creates unique exploitation opportunities.

Agentic Workflow Pattern Attacks

AI agents execute tasks through structured workflow patterns: sequential pipelines where each step feeds the next, parallel execution where multiple operations run simultaneously, and hierarchical systems where manager agents delegate to worker agents. Each pattern creates distinct attack opportunities. Sequential workflows allow early-stage poisoning that corrupts all downstream steps. Parallel execution introduces race conditions and output aggregation vulnerabilities. Hierarchical systems enable delegation-based privilege escalation. Understanding these patterns is essential for systematic red team assessment of agentic systems.

Workflow Pattern Taxonomy

How Workflow Structure Creates Vulnerabilities

Sequential Vulnerability: Cascading Corruption

In sequential workflows, each step trusts the output of the previous step. An attacker who poisons step 1 corrupts every subsequent step:

Step 1 (Search): Returns poisoned results containing injection
    ↓ (poisoned output flows downstream)
Step 2 (Analysis): Follows injected instructions from Step 1
    ↓ (corruption amplified)
Step 3 (Summary): Produces a compromised summary
    ↓ (poisoned summary propagated)
Step 4 (Action): Takes malicious action based on corrupted data

The corruption amplifies at each step because each step adds its own interpretation of the poisoned input, making the injection increasingly difficult to trace back to its source.

Parallel Vulnerability: Consistency Conflicts

In parallel workflows, multiple operations run simultaneously and their results are combined. An attacker can create conflicts between parallel branches:

     ┌─ Branch A: Returns "Budget: $10M" (legitimate)
     │
Start┤─ Branch B: Returns "Budget: $100M" (poisoned data source)
     │
     └─ Branch C: Returns "Budget: $10M" (legitimate)

Aggregation: Which value does the model trust? The poisoned
branch may win through stronger framing or by including
authoritative-sounding context.

Hierarchical Vulnerability: Authority Exploitation

In hierarchical workflows, the manager's decisions determine what workers do. Manipulating the manager provides leverage over all workers:

Manager (manipulated to delegate malicious task)
    ├─ Worker A (executes malicious task with its tools)
    ├─ Worker B (unaware, continues normal work)
    └─ Worker C (receives poisoned input from Worker A's results)

Common Workflow Patterns in Production

Understanding which products use which patterns helps focus red team assessments:

Assessment Methodology

1. 1

   Identify the workflow pattern

   Determine whether the agent uses sequential, parallel, hierarchical, or hybrid patterns. Map the data flow between steps, identify trust boundaries, and document which steps have access to external data sources.

2. 2

   Map injection points

   For each step in the workflow, identify where external (potentially attacker-controlled) data enters. This includes tool outputs, retrieved documents, API responses, and inter-agent messages.

3. 3

   Test upstream poisoning

   For sequential workflows, inject adversarial content at the earliest possible step and monitor how it propagates through subsequent steps. Document the amplification factor (how much the injection grows as it passes through steps).

4. 4

   Test parallel conflicts

   For parallel workflows, create conflicting outputs between branches and observe which branch's output dominates the aggregation. Test whether the aggregation can be steered through authoritative framing.

5. 5

   Test delegation manipulation

   For hierarchical workflows, attempt to influence the manager's delegation decisions. Test whether workers can be assigned tasks outside their intended scope.

6. 6

   Test checkpoint integrity

   Identify any checkpoints, validation steps, or human-in-the-loop mechanisms in the workflow. Test whether these can be bypassed or manipulated.

Cross-Pattern Defenses

Related Topics

• Sequential Workflow Exploitation -- Detailed sequential attack techniques
• Parallel Execution Attacks -- Race conditions and aggregation manipulation
• Hierarchical Agent Attacks -- Manager/worker exploitation
• Agent Exploitation -- Foundational agent attack taxonomy

References

• Wu et al., "AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks" (2024)
• Debenedetti et al., "AgentDojo" (2024)
• OWASP Top 10 for LLM Applications v2.0