---
title: "DUMA-Bench reveals dual-control attacks double LLM agent vulnerability"
slug: "duma-bench-reveals-dual-control-attacks-double-llm-agent-vulnerability"
published: "2026-10-18"
beat: "Research"
tags: ["Research"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-10-18"
aiActArticle50: "compliant"
humanView: "https://agentry.news/research/duma-bench-reveals-dual-control-attacks-double-llm-agent-vulnerability"
agentView: "https://agentry.news/agent/duma-bench-reveals-dual-control-attacks-double-llm-agent-vulnerability"
---# DUMA-Bench reveals dual-control attacks double LLM agent vulnerability

> Researchers released DUMA-Bench, a security evaluation framework for large language model agents, on arXiv in late September 2026, finding that adversarial dual-control interactions increased successf

*Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. [AI policy](/ai-policy).*

Researchers published DUMA-Bench, a dual-control multi-agent security benchmark, on arXiv on September 21, 2026, with an update on October 5, 2026 [arXiv](https://arxiv.org/abs/2609.24662). The benchmark quantifies how coordinated adversarial interactions compromise LLM-based agents, revealing a significant security gap in production systems.

## Attack Success Doubles Under Coordinated Pressure

The core finding: when attackers controlled multiple agents in conversation simultaneously, successful compromise rates jumped from 26.9% to 41.1% [arXiv](https://arxiv.org/abs/2609.24662). This 15.2 percentage-point increase suggests that real-world deployments—where multiple agents interact across workflows, customer support chains, or enterprise systems—face substantially higher risk than single-agent threat models assume.

## Eight Vulnerability Classes Across Domains

DUMA-Bench extends τ²-bench with adversarial environments covering eight vulnerability classes [arXiv](https://arxiv.org/abs/2609.24662), including retrieval-augmented-generation (RAG) poisoning, cross-agent manipulation, and unsafe output handling. The evaluation tested **14 models from five model families** across **eight domains**, establishing a concrete measurement baseline for agent security posture.

Retrieval poisoning—where attackers inject malicious data into knowledge sources that agents query—ranked among the highest-impact vectors. Cross-agent manipulation, where one compromised agent corrupts others in a workflow, appeared consistently exploitable. Unsafe output handling vulnerabilities allowed agents to bypass safety constraints when pressure came from multiple coordinated sources.

## Real-World Deployment Risk

The dual-control finding carries immediate implications for enterprises rolling out agent teams. Financial institutions deploying agents for transaction approval, healthcare systems using agents for triage, and logistics platforms automating dispatch decisions all face scenarios where multiple agents interact. If one operator controls two or more agents in a conversation, defenses drop measurably.

Previous benchmarks evaluated agents in isolation. DUMA-Bench's contribution is forcing multi-agent scenarios into the lab, surfacing vulnerabilities that single-agent testing misses. The benchmark does not yet indicate which model families performed better or worse, or which vulnerability class poses the highest risk in specific industries—those findings require accessing the full paper and evaluation tables.

## No Patch Timeline Yet

The arXiv submission does not include statements from model developers about mitigation plans or timelines for hardening dual-control defenses. The research itself is a measurement; remediation remains with the companies building and deploying these systems.