Multi-Agent Systems

ATLAS attacks a multi-agent system - a pipeline of cooperating agents with tools and trust boundaries - over a single HTTP contract. This page is for when that system runs in your own cloud (AWS, Azure, or anywhere): you already have it deployed and reachable at a URL, and you want to red team it.

Note

This is a bring-your-own-cloud target. The multi-agent system runs in your account and ATLAS reaches it over HTTP. It’s independent of the platform-provided dn/… models — those only concern the attacker/judge LLMs, not where the target system runs. For a system the platform hosts for you instead, see Multi-Agent Red Teaming.

The target contract

A multi-agent target is any HTTP service your system exposes that answers:

POST /attack
  { "prompt": "...", "surface": "direct|tool_output|peer_message", "injection": "..." }
->
  { "content": "...", "tool_calls": [ {agent, tool, arguments, result}, ... ],
    "cascade_depth": N, "boundary_crossings": N, "agents_touched": [...] }

• surface selects where ATLAS injects: direct (entry agent), tool_output (a tool’s return), or peer_message (an inter-agent delegation).
• tool_calls is the evidence ATLAS gates on — a {agent, tool, arguments, result} per executed call, including tools fired by delegated agents.

Any deployment that answers this contract works. The per-cloud pages below assume you already have it running and give the exact SDK and TUI steps to red team it.

Azure Red team a multi-agent system deployed on Azure (Container Apps, AKS, App Service).

AWS Red team a multi-agent system deployed on AWS (App Runner, ECS Fargate, EKS).

What you get in findings

For every deployment, findings render the same way:

• Per trial - the executed tool calls (agent · name(arguments) → result).
• Per finding - the distinct Tools Invoked across trials.
• Compliance - ATLAS categories populate the OWASP Agentic Top 10 matrix.

See Multi-Agent Red Teaming for the ATLAS algorithm, injection surfaces, and category reference.