Trust the Brand, Lose Control: How Identity Hijacks LLM Agent Orchestration
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
LLM agents now execute tasks end to end with permission to change real systems and increasingly orchestrate subagents that differ in capability and cost. Prior work treats the choice of subagent as an optimization problem. Yet the orchestrator makes this choice from the identities that subagents display, and an attacker can spoof them. Displayed identity thus decides operational authority, meaning who is trusted to check the work and who is allowed to change it. As a result, a risky subagent can keep authority over execution even after other evidence contradicts it. We introduce TrustFork, an LLM agent safety benchmark with 1,890 tasks and 27,826 valid trajectories across 16 agent systems. These systems run eight orchestrators under the OpenCode, OpenClaw, and Pi harnesses. In each task, one subagent carries a risky goal while the other three stay aligned with the user, so contradicting evidence can exist. A task can also change the identity a subagent displays without changing the model behind it, which lets us trace a shift in authority to the label. Our analysis shows that even when another subagent contradicts the risky response, the orchestrator still acts on it in 72.0% of cases on average, most often in the systems with the least terminal harm. Swapping the family labels nearly triples how often the orchestrator obtains the risky response. A safer response is available in 84.0% of tasks, yet it decides the outcome in only 25.0%. The harness also decides which responses reach the orchestrator. Among three runtime defenses, hiding identity cues helps most consistently, while verifying before action helps only when the harness returns enough evidence. TrustFork shows that production agent orchestration must bind authority to evidence before execution causes harm. Our project is in https://henrymao2004.github.io/agent-orchestration-safety/.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 33 of its 47 references that are in the map. First posted on arXiv 26 Sep 2026.
Builds on
33 of 47 references.
Closest ancestors · 15
Same direction, newest first
- 2026OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences18 May
- 2026Auditing Agent Harness Safety14 May
- 2026SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces12 May
- 2026ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis2 Apr
- 2026LDP: An Identity-Aware Protocol for Multi-Agent LLM Systems9 Mar
- 2026Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents13 Feb
- 2025Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting14 Nov
- 2025TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems7 Nov
- 2025Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems20 Oct
- 2025AI Agents with Decentralized Identifiers and Verifiable Credentials1 Oct
- 2025MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers19 Aug
- 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise9 Jul
3 more
Other references · 18
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,761
- 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 877
- 2024RouteLLM: Learning to Route LLMs with Preference Datacited by 633
- 2025Multi-Agent Collaboration Mechanisms: A Survey of LLMscited by 424
- 2024Hybrid LLM: Cost-Efficient and Quality-Aware Query Routingcited by 354
- 2024RouterBench: A Benchmark for Multi-LLM Routing Systemcited by 222
- 2025MultiAgentBench: Evaluating the Collaboration and Competition of LLM agentscited by 169
- 2025MasRouter: Learning to Route LLMs for Multi-Agent Systemscited by 80
- 2026AOrchestra: Automating Sub-Agent Creation for Agentic Orchestrationcited by 30
- 2025When Identity Skews Debate: Anonymization for Bias-Reduced Multi-Agent Reasoningcited by 20
- 2026AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environmentscited by 10
- 2026Agent-as-a-Router: Agentic Model Routing for Coding Taskscited by 10
6 more
- 2026Failing to Falsify: Evaluating and Mitigating Confirmation Bias in Language Modelscited by 9
- 2026LLMs Corrupt Your Documents When You Delegatecited by 9
- 2026MTRouter: Cost-Aware Multi-Turn LLM Routing with History-Model Joint Embeddingscited by 7
- 2025Quantifying Label-Induced Bias in Large Language Model Self- and Cross-Evaluationscited by 3
- 2026In Agents We Trust, but Who Do Agents Trust? Latent Source Preferences Steer LLM Generationscited by 3
- 2026ClawArena-Team: Benchmarking Subagent Orchestration and Dynamic Workflows in Language-Model Agentscited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- 2026Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
- 2026Reframing LLM Agent Security as an Agent-Human Interaction Problem
- 2026Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control
- 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactions
- 2026Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents
- 2026Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback