How do you benchmark security in multi-agent systems?

With an auditable sandbox that runs realistic cross-user tasks, records every peer message, tool call, resource operation, governed decision, and final workspace state, and reports task utility and attack success rate separately — auditing attack success from bounded runtime evidence rather than guessing.

← Writing

How Do You Secure Multi-User AI Agent Networks?

Q: What is a human-centered agent network?

It is a setting where each user is served by a persistent AI agent that acts on their behalf, maintains state, and communicates with other users' agents through social and task relationships. Everyday tool use becomes multi-party collaboration over personal workspaces whose files, records, and policies are not directly visible across owners.

Q: What is cross-user agent security?

It is the study of how harmful actions can travel between users through a network of collaborating agents — for example task breakdown, privacy leakage, poisoned evidence, or invalid authority paths — when agents share tasks but not full visibility into each other's workspaces.

By Aojie (Justin) Yuan · August 2026 · ~6 min read

TL;DR — When every person has an AI agent acting on their behalf, agents start collaborating across owners — and harm can travel between users through shared tasks. This is cross-user agent security. WeClawArena measures it with an auditable sandbox: 124 base tasks across six cross-user domains expanded into 620 scenario variants (one benign control + four attack vectors each). It records peer messages, tool calls, resource operations, governed decisions, and workspace states, then reports utility and attack-success rate separately — auditing harm from bounded runtime evidence.

Single-agent safety asks: will this agent do something harmful? Human-centered agent networks change the question. Now each user has a persistent agent that acts for them, holds state, and talks to other users' agents over social and task relationships. Everyday tool use becomes multi-party collaboration over personal workspaces — where files, records, tools, and policies are not directly visible across owners. The new risk isn't just a bad agent; it's harm that travels.

How harm travels between users

In a network of owned agents, an action taken for one user can ripple into another's workspace. The failure modes are structural, not just prompt-level:

Task breakdown — a delegated subtask silently fails or is subverted downstream.
Privacy leakage — data crosses an owner boundary it shouldn't.
Poisoned evidence — one agent feeds another false information that drives a bad decision.
Invalid authority paths — an action executes through a chain that never actually had permission.

Existing agent benchmarks study tool use and collaboration, but not an end-to-end sandbox for verifiable cross-user collaboration with realistic personal workspaces — so these travel-through-the-network harms go unmeasured.

The idea: an auditable sandbox, not a vibe check

You can't secure what you can't measure, and you can't measure agent harm by eyeballing transcripts. WeClawArena is a runtime sandbox where personal workspaces serve as both the operational tools and the personal constraints. It:

Runs 124 base tasks across six cross-user domains, expanded into 620 scenario variants — one benign control plus four attack-vector variants per base task.
Records the full evidence trail: peer messages, tool calls, resource operations, governed decisions, and final workspace states.
Reports utility and attack-success rate separately, so a helpful-but-unsafe agent can't hide behind its task score.

Audit attack success from bounded runtime evidence — don't infer it.

Because everything is recorded, attack success is audited from the evidence, which also supports diagnosis: was this a task breakdown, a privacy leak, poisoned evidence, or an invalid authority path?

Why "auditable" is the load-bearing word

The benchmark's power comes from the same principle as an audit layer: make behavior inspectable from a tamper-evident record. Here it operates at the network scale — across users and agents — turning "we think it's safe" into "here's the evidence of exactly what crossed which boundary."

Frequently asked questions

What is a human-centered agent network?

A setting where each user has a persistent agent that acts for them and collaborates with other users' agents over shared tasks and personal workspaces.

What is cross-user agent security?

The study of how harm — task breakdown, privacy leakage, poisoned evidence, invalid authority paths — travels between users through collaborating agents.

How do you benchmark it?

With an auditable sandbox that runs realistic cross-user tasks, records the full evidence trail, and reports utility and attack-success rate separately.

Written by Aojie (Justin) Yuan. WeClawArena appears at EMNLP 2026 (arXiv:2608.03499).