Shattered Intent: Payload Sharding Attacks on Multi-Agent LLM Systems

Multi-agent systems (MAS) decompose complex tasks across specialized agents, with each agent accessing only the inputs assigned to its role. We show that this structure creates a vulnerability we term payload sharding, where a malicious payload is split into individually benign shards distributed across agents. We instantiate the attack as Mosaic, which decomposes a payload along intent, logic, and target boundaries aligned with the plan-code-execute workflow of code-generating MAS. Shards are synthesized by an iterative procedure that generates a cover context, decouples logic from sensitive parameters, and verifies via LLM auditing that each shard appears benign in isolation. Mosaic achieves $92.9\%$ ASR across five LLMs and five MAS architectures, exceeding the strongest prior attack by $14.9\%$. Under defenses, it retains $77.8\%$ ASR against LlamaFirewall and $63.0\%$ against LLM-based cross-artifact auditing.