Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems

Abstract: This paper proposes a novel architectural framework aimed at enhancing security and reliability in multi-agent systems (MAS). A central component of this framework is a network of Sentinel Agents, functioning as a distributed security layer that integrates techniques such as semantic analysis via LLMs, behavioral analytics, retrieval-augmented verification, and cross-agent anomaly detection. Such agents can potentially oversee inter-agent communications, identify potential threats, enforce privacy and access controls, and maintain comprehensive audit records. Complementary to the idea of Sentinel Agents is the use of a Coordinator Agent. The Coordinator Agent supervises policy implementation, and manages agent participation. In addition, the Coordinator also ingests alerts from Sentinel Agents. Based on these alerts, it can adapt policies, isolate or quarantine misbehaving agents, and contain threats to maintain the integrity of the MAS ecosystem. This dual-layered security approach, combining the continuous monitoring of Sentinel Agents with the governance functions of Coordinator Agents, supports dynamic and adaptive defense mechanisms against a range of threats, including prompt injection, collusive agent behavior, hallucinations generated by LLMs, privacy breaches, and coordinated multi-agent attacks. In addition to the architectural design, we present a simulation study where 162 synthetic attacks of different families (prompt injection, hallucination, and data exfiltration) were injected into a multi-agent conversational environment. The Sentinel Agents successfully detected the attack attempts, confirming the practical feasibility of the proposed monitoring approach. The framework also offers enhanced system observability, supports regulatory compliance, and enables policy evolution over time.

• The paper presents a framework where Sentinel Agents monitor agent interactions to detect prompt injection and malicious behaviors, achieving 100% detection in tests.
• The methodology utilizes sidecar, LLM proxy, and continuous listener patterns combined with regex and anomaly detection for effective threat mitigation.
• Experimental evaluations validate the approach, highlighting its potential for scalable security enhancements in multi-agent systems while outlining future research directions.

Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems

The paper "Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems" (2509.14956) introduces a comprehensive architectural framework aimed at enhancing the security and reliability of multi-agent systems (MAS). By proposing the integration of Sentinel Agents, the framework addresses various threats posed in conversational AI environments, ranging from prompt injection to malicious agent behavior and privacy breaches. This essay will outline the Sentinel Agents' role and architecture, explore practical applications, compare this approach with existing frameworks, and conclude with experimental evaluations and future directions.

Sentinel Agent Architecture

Core Concept and Design

Sentinel Agents are conceived as specialized AI components embedded within MAS to monitor and analyze interactions between agents. Their role is to detect anomalies, apply security policies, and identify potential threats in real time. Unlike traditional agent-specific security measures, Sentinel Agents offer a standardized, globally aware layer of protection by separating operational logic from security controls.

Deployment Patterns

The paper outlines several architectural patterns for deploying Sentinel Agents:

• Sidecar Pattern: A Sentinel Agent operates as a companion process to each main agent, intercepting and inspecting interactions locally. This pattern ensures low latency and fine-grained control but adds overhead for each agent.

  Figure 1: Sidecar Pattern for Sentinel Agent

• LLM Proxy Pattern: A centralized proxy that filters all transactional data, enforcing global policies and maintaining consistency across agents. This pattern is more scalable but can introduce latencies if not optimized.

  Figure 2: LLM Proxy Pattern for Sentinel Agent

• Continuous Listener Pattern: An independent Sentinel Agent observes the entire conversational space without intervening directly, ideal for detecting systemic trends or threats.

  Figure 3: Continuous Listener Pattern: Sentinel Agent as an independent, system-wide observer of the Shared Conversational Space.

Comparisons with other protocols like MCP, A2A, and ANP reveal that while those focus on interoperability and direct agent-to-agent communication, Sentinel Agents emphasize overall conversational security and integrity.

Practical Applications

Addressing Threats

1. Prompt Injection Defense: Sentinel agents employ regex, anomaly detection, and adaptive measure layers to identify and neutralize prompt injection attempts, preventing potential security breaches while allowing prompt evolution based on gathered intelligence.
2. Malicious Behavior: By analyzing the sequences of messages rather than isolated utterances, Sentinel Agents can detect deceptive patterns, collusion, and other malicious activities, triggering appropriate administrative responses via the Coordinator Agent.
3. Hallucination Mitigation: Integrating with external factual databases and consensus strategies among agents ensures that erroneous outputs by LLMs are quickly identified and corrected.
4. Privacy Protections: By enforcing identity concealment and frequent anomaly detection, Sentinel Agents ensure compliance with data protection frameworks, safeguarding personally identifiable information from unauthorized access.

Comparative Analysis

Position within Existing AI Security Frameworks

Sentinel Agents offer a pragmatic solution that effectively transforms theoretical security concepts of major AI risk frameworks (such as NIST AI RMF and OWASP Top 10 for LLMs) into operational protocols. By providing both proactive and reactive security measures, Sentinel Agents complement these frameworks' general guidelines with concrete implementations that align security processes with MAS's specific requirements.

Experimental Evaluation

Proof-of-Concept Study

An experimental prototype involving layered detection capabilities of Sentinel Agents was tested using 162 adversarial prompts. The Sentinel Agent demonstrated a 100\% detection rate, validating the proposed architectural components in identifying diverse adversarial threats.

Figure 4: Prompt-injection risk distribution across 110 adversarial attempts.

Limitations and Future Work

Although successful in detecting synthetic adversaries, this evaluation requires refinement. Future work should expand on detailed ablation studies, explore more comprehensive datasets including benign examples, and quantitatively assess false positive rates for robust benchmarking.

Figure 5: Detection rate (\%) by attack type, including prompt injection, hallucination, and data exfiltration attempts.

Conclusion

By introducing Sentinel Agents into MAS, this framework supports secure, adaptable, and cross-platform agent interactions essential for modern AI applications. While demonstrating promising results, further research is needed to cement its efficacy in varied real-world contexts. This paper lays a foundational framework for making MAS systems resilient against evolving threats via seamless and consistently evolving trust, governance, and security layers. Future studies should focus on scalability, unit economics, and ethical implementation challenges in diverse industry settings.