The Pulse
One Stubborn AI Agent Can Steer a Multi-Agent Network
A study of language-model multi-agent systems finds that one highly stubborn and persuasive agent can trigger a persuasion cascade and reshape a group’s collective opinion.
AI.info Team ·
One highly stubborn and persuasive AI agent can steer the collective decision of a larger group, according to a study that models how misinformation spreads through networks of cooperating agents. The researchers found that a malicious or compromised agent can exploit ordinary communication channels to propagate misinformation and manipulate collective outcomes.
The study, “Don’t Trust Stubborn Neighbors: A Security Framework for Agentic Networks,” comes from Samira Abedini, Sina Mavali, Lea Schönherr, Martin Pawelczyk and Rebekka Burkholz. The paper was submitted to arXiv on March 16, 2026.
One attacker, many persuadable agents
Multi-agent systems use multiple language-model agents to handle tasks such as web automation, itinerary planning and collaborative problem solving. Because the agents interact and exchange assessments, a compromised participant can use those interactions to influence the group.
The researchers describe this as a persuasion cascade. A highly stubborn agent remains attached to its initial position while other agents repeatedly update their own views in response to the information circulating through the network. The result can be a shift in collective opinion away from the beliefs held by benign agents at the start.
Friedkin-Johnsen model maps the attack
To study how opinions form and spread, the researchers adapted the Friedkin-Johnsen model from the social sciences. The framework represents how strongly an agent holds to its original view, how readily it changes in response to other agents and how much influence participants exert on one another.
The paper reports that the model closely captures the behavior of language-model multi-agent systems. The researchers tested it through experiments involving different network topologies, attack strategies and defenses. This combination of theoretical analysis and experiments allowed them to examine both the conditions that help manipulation spread and the measures that can limit it.
The analysis identifies three ways to increase system security: increase the number of benign agents, increase their innate stubbornness or resistance to peer influence, and reduce trust in potential adversaries. Each measure has a cost. Adding agents increases computational demands, while making benign agents less willing to change their views can make it harder for the network to reach consensus.
Trust can be adjusted over time
The researchers propose a trust-adaptive defense that dynamically adjusts inter-agent trust. The mechanism is intended to limit the influence of adversarial agents while preserving the system’s ability to cooperate.
Under this approach, an agent’s influence can change according to its observed performance. Agents that repeatedly produce incorrect answers can receive less trust, reducing the effect of their future statements on the group’s assessments. The defense does not depend only on identifying malicious intent; it uses performance information to adjust how much influence each participant receives.
The paper reports that experiments confirmed the defense can reduce manipulation. It also identifies a trade-off: high stubbornness among benign agents can protect the network from persuasion, but it can also damage the group’s ability to reach agreement.
A security problem inside normal collaboration
The study presents a theoretical framework and controlled experiments rather than a documented attack against a deployed commercial agent network. Its finding is narrower: when language-model agents depend on one another’s assessments, a persistent participant can exploit that dependence through the same communication process used for ordinary collaboration.
The paper’s results make communication patterns and trust assignments security considerations for multi-agent systems. A network that gives substantial weight to every participant may be more vulnerable to a single agent that refuses to change its position. A network that continually evaluates performance and adjusts trust can limit that agent’s reach, though it may also make coordination more complex.