# Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems

arXiv: https://arxiv.org/abs/2509.14956 · HTML: https://mlsanity.com/paper/2509.14956/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 6 of its 24 references that are in the map.
- First posted on arXiv 18 Sep 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 6 of 6)

- [From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows](https://mlsanity.com/paper/2506.23260/) (2025)
- [Prompt Injection Detection and Mitigation via AI Multi-Agent NLP Frameworks](https://mlsanity.com/paper/2503.11517/) (2025)
- [AI Multi-Agent Interoperability Extension for Managing Multiparty Conversations](https://mlsanity.com/paper/2411.05828/) (2024)
- [Multi-Trigger Poisoning Amplifies Backdoor Vulnerabilities in LLMs](https://mlsanity.com/paper/2507.11112/) (2025)
- [Conversational AI Multi-Agent Interoperability, Universal Open APIs for Agentic Natural Language Multimodal Communications](https://mlsanity.com/paper/2407.19438/) (2024)
- [Modeling Response Consistency in Multi-Agent LLM Systems: A Comparative Analysis of Shared and Separate Context Approaches](https://mlsanity.com/paper/2504.07303/) (2025)

## Built on by (most cited first, 8 of 8)

- [Security Risks of Agentic Vehicles: A Systematic Analysis of Cognitive and Cross-Layer Threats](https://mlsanity.com/paper/2512.17041/) (2025)
- [Prompt Injection Mitigation with Agentic AI, Nested Learning, and AI Sustainability via Semantic Caching](https://mlsanity.com/paper/2601.13186/) (2026)
- [TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents](https://mlsanity.com/paper/2606.07054/) (2026)
- [Agentic AI Sustainability Assessment for Supply Chain Document Insights](https://mlsanity.com/paper/2511.07097/) (2025)
- [MADP: A Multi-Agent Pipeline for Sustainable Document Processing with Human-in-the-Loop](https://mlsanity.com/paper/2605.17159/) (2026)
- [Hallucination Mitigation with Agentic AI, Nested Learning, and AI Sustainability via Semantic Caching](https://mlsanity.com/paper/2605.29055/) (2026)
- [Agentic AI for Cybersecurity: A Meta-Cognitive Architecture for Governable Autonomy](https://mlsanity.com/paper/2602.11897/) (2026)
- [AgentSpy: Making AI Agent Behavior Observable](https://mlsanity.com/paper/2610.06001/) (2026)

## Abstract (arXiv)

This paper proposes a novel architectural framework aimed at enhancing security and reliability in multi-agent systems (MAS). A central component of this framework is a network of Sentinel Agents, functioning as a distributed security layer that integrates techniques such as semantic analysis via large language models (LLMs), behavioral analytics, retrieval-augmented verification, and cross-agent anomaly detection. Such agents can potentially oversee inter-agent communications, identify potential threats, enforce privacy and access controls, and maintain comprehensive audit records. Complementary to the idea of Sentinel Agents is the use of a Coordinator Agent. The Coordinator Agent supervises policy implementation, and manages agent participation. In addition, the Coordinator also ingests alerts from Sentinel Agents. Based on these alerts, it can adapt policies, isolate or quarantine misbehaving agents, and contain threats to maintain the integrity of the MAS ecosystem. This dual-layered security approach, combining the continuous monitoring of Sentinel Agents with the governance functions of Coordinator Agents, supports dynamic and adaptive defense mechanisms against a range of threats, including prompt injection, collusive agent behavior, hallucinations generated by LLMs, privacy breaches, and coordinated multi-agent attacks. In addition to the architectural design, we present a simulation study where 162 synthetic attacks of different families (prompt injection, hallucination, and data exfiltration) were injected into a multi-agent conversational environment. The Sentinel Agents successfully detected the attack attempts, confirming the practical feasibility of the proposed monitoring approach. The framework also offers enhanced system observability, supports regulatory compliance, and enables policy evolution over time.