One Poisoned Worker Description Drops Multi-Agent GAIA Success From 84.31% to 37.25% Without Ever Being Invoked

arXiv 2609.15516·high signalXBlueskyLinkedInCopy link

In centralized multi-agent systems, third-party worker descriptions are read by the planner and trusted at registration time, before any user instruction arrives. Across 32,000 descriptions from three public agent marketplaces, most omit input specifications and usage constraints and at least 23.35% contain content outside the four defined fields. Eight description-manipulation strategies evaluated on GAIA cut task success from 84.31% to 37.25% in the worst case, or raise token consumption and execution time by over 111%, and the payload takes effect even when the crafted worker is never assigned a subtask.