When AI Agents Trust Each Other – and Why That's a Security Problem

The Trust Problem in the Age of Autonomous AI Systems

Anyone thinking about AI-driven automation in business today quickly encounters what appears to be a technical detail but is in reality a fundamental strategic question: How much trust should a system be allowed to place in itself? With the rise of so-called Agentic AI – autonomous AI agents that independently plan, delegate, and execute tasks – this question has moved to the centre of the security debate. A recent analysis from the research group at Queen's University Belfast shows that existing security models, particularly Zero-Trust architectures, are reaching conceptual limits under the pressure of networked AI agents.

What Is Zero-Trust – and Why Is It No Longer Sufficient on Its Own?

The principle of Zero-Trust Architecture (ZTA) is well established: never trust automatically, always verify. Every access request, every interaction is checked, regardless of whether it originates from inside or outside the system. In traditional IT environments, this works well. But when autonomous AI agents collaborate within a network – directed by a so-called orchestrator that distributes and coordinates tasks – a fundamental dilemma arises.

The critical point lies with the Policy Enforcement Point (PEP), the central component that enforces policies. This component must itself be considered trustworthy for the entire system to function. In doing so, however, the original Zero-Trust promise is broken: there is, after all, a trusted authority – and that authority becomes the preferred target of attack.

The classic Zero-Trust model was designed for static systems with human oversight – not for autonomously acting AI agents that make and pass on decisions within milliseconds.

Multi-Agent Systems in Practice: Efficiency and Blind Spots

Numerous teams worldwide are today building applications on the basis of networked AI agents – for risk assessment, customer profiling, information analysis, or automated decision support. The efficiency gains are real and measurable. Yet with complexity, the attack surface grows as well.

A particularly insidious problem is the so-called Context Recovery Attack: agents are deliberately instructed to delete certain historical logs in order to prevent distortion of future decisions. However, a subsequent prompt can cause this information to be reconstructed nonetheless – the agent is essentially induced into surfacing deleted content. Whether instructions were actually followed can barely be reliably determined within a running system.

Dr. Maik Bunzel, founder and managing director of mabucon.eu, sees this as one of the central challenges for companies seeking to leverage agent-based automation: "The performance of multi-agent systems stands or falls with the quality of the governance layer behind them. An agent you trust without being able to verify that trust is not an automation advantage – it is an uncontrolled risk."

Vibe Coding and External Models: Underestimated Entry Points

Another aspect deserves particular attention: the trend known as Vibe Coding. This is where development teams use AI models to generate or revise software code – often at considerable speed and without fully reviewing the outputs. The problem arises when substantial portions of a company's own codebase are handed over to external models that cannot be fully controlled. Security vulnerabilities that emerge in this process can spread across multiple system surfaces – a phenomenon researchers call Vulnerability Sweeping.

For companies, this means: not only the AI agents themselves, but also the tools used to develop and train them must be included in security considerations. Blindly relying on off-the-shelf models without company-specific Guardrails is not a question of budget, but of risk awareness.

De-authentication attacks in seconds – the time window is shrinking

An experiment from Belfast illustrates particularly vividly how strongly agent-based systems are changing the dynamics of cyberattacks. In classical de-authentication attacks on networked systems – i.e., the targeted interruption of legitimate connections – agent-supported orchestration was able to compress response time to two to three seconds. That is a time window in which virtually no human security team can react.

This finding has immediate implications for every company integrating autonomous agents into security-critical infrastructure: the attack surface is growing not only in breadth, but also in speed. Systems with low fault tolerance that rely on non-traceable agent workflows are particularly at risk – because real-time verification of every agent request is simply not computationally feasible in every scenario.

Horizontal anomalies: the overlooked risk in agent networks

A conceptually new risk profile is emerging around the term horizontal anomalies. What this means is: an AI agent that operates reliably and in compliance with rules for a specific task does not necessarily do so in other contexts or when interacting with other system components. Behavior is context-dependent – and therefore harder to standardize than previously assumed.

This insight is relevant for companies that want to build agent systems in a modular fashion and expand them incrementally. Validating an agent in a defined environment is not a free pass for its behavior across the entire system landscape.

Solution approaches: traceability, distributed ledger, and AI-BOM

Research also points to possible ways forward. Two approaches deserve particular attention: first, the introduction of an AI Bill of Materials (AI-BOM) – a structured documentation of all components, models, and dependencies of an AI system, analogous to the well-known Software Bill of Materials. Second, the use of Distributed Ledger Technology, which can create a platform-independent trust infrastructure through immutability and traceability.

Both approaches aim not to presuppose trust, but to make it demonstrably verifiable – and thereby fulfill the actual promise of Zero-Trust even in agent-based environments. Dr. Maik Bunzel, founder and CEO of mabucon.eu, emphasizes in this context that companies should anchor auditability as a design principle from the very beginning when building automation infrastructures – not as a retrospective compliance feature.

What Companies Should Do Now

• Governance before speed: Organizations introducing multi-agent systems should first clarify which decisions agents are permitted to make autonomously – and which require human review.
• Auditability as a requirement: Every agent interaction should be documented in a traceable manner. Systems without a logging concept are not suitable for security-critical applications.
• Deploy external models deliberately: AI services from third-party providers – including for development tasks – should only be integrated into workflows following a clear data protection and security review.
• Plan for redundant trust layers: A single trusted layer within a system is a single point of failure. Robust architectures distribute trust responsibility across multiple levels.
• Think about anomaly detection horizontally: Test scenarios should not only examine individual agents in isolation, but also capture their behavior in interaction with other system components.

Conclusion: Trust Must Be Earned – and Provable

Agentic AI is not a hype cycle that will simply pass – it is the logical evolution of automation. Yet with autonomy comes responsibility, and current technical security models are still lagging behind this development. Zero-Trust is not an outdated concept, but an incomplete one – it must be rethought and extended for the agent-based world.

For companies, this means: Adopting workflow automation with AI agents is both sensible and economically attractive. But it demands a security maturity that goes far beyond setting up a firewall. As Dr. Maik Bunzel, founder and CEO of mabucon.eu, puts it: Those who put the right Guardrails in place today can fully harness the speed of automation tomorrow – those who forgo this will pay the price later, under far worse conditions.