<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="li-etal-2026-orcajack">
    <titleInfo>
        <title>OrcaJack: Hijacking Agent Orchestration in Open Multi-Agent Systems</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Xiang</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Haining</namePart>
        <namePart type="family">Yu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Wenbo</namePart>
        <namePart type="family">Pan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Hongli</namePart>
        <namePart type="family">Zhang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xiaohua</namePart>
        <namePart type="family">Jia</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Google’s Agent-to-Agent (A2A) protocol transforms multi-agent collaboration from a closed pipeline into an open and dynamic ecosystem. A2A-based multi-agent systems typically depend on a central orchestrator to coordinate task allocation across agents. However, this paradigm exposes a new attack surface at the agent-orchestration layer: an agent provider can forge an adversarial agent profile to bias the orchestrator’s decisions. We find this risk and propose OrcaJack, an agent orchestration hijacking attack. By injecting a deceptively appealing agent profile into the agent pool, OrcaJack causes user queries in a target domain to be consistently routed to the malicious agent. We formulate the adversarial agent profile construction process as a discrete optimization problem and solve it with a domain-skill-driven genetic algorithm. Across multiple domain benchmarks and orchestrator LLMs, Orcajack can reach up to 100% routing rate, while simple pool-side defenses fail to flag the crafted profiles. Our work is the first to expose the over-trust of agent-declared capabilities in modern agent discovery, motivating pool-side validation defenses.</abstract>
    <identifier type="citekey">li-etal-2026-orcajack</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.1682/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>35911</start>
            <end>35929</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T OrcaJack: Hijacking Agent Orchestration in Open Multi-Agent Systems
%A Li, Xiang
%A Yu, Haining
%A Pan, Wenbo
%A Zhang, Hongli
%A Jia, Xiaohua
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F li-etal-2026-orcajack
%X Google’s Agent-to-Agent (A2A) protocol transforms multi-agent collaboration from a closed pipeline into an open and dynamic ecosystem. A2A-based multi-agent systems typically depend on a central orchestrator to coordinate task allocation across agents. However, this paradigm exposes a new attack surface at the agent-orchestration layer: an agent provider can forge an adversarial agent profile to bias the orchestrator’s decisions. We find this risk and propose OrcaJack, an agent orchestration hijacking attack. By injecting a deceptively appealing agent profile into the agent pool, OrcaJack causes user queries in a target domain to be consistently routed to the malicious agent. We formulate the adversarial agent profile construction process as a discrete optimization problem and solve it with a domain-skill-driven genetic algorithm. Across multiple domain benchmarks and orchestrator LLMs, Orcajack can reach up to 100% routing rate, while simple pool-side defenses fail to flag the crafted profiles. Our work is the first to expose the over-trust of agent-declared capabilities in modern agent discovery, motivating pool-side validation defenses.
%U https://aclanthology.org/2026.findings-emnlp.1682/
%P 35911-35929

Markdown (Informal)

[OrcaJack: Hijacking Agent Orchestration in Open Multi-Agent Systems](https://aclanthology.org/2026.findings-emnlp.1682/) (Li et al., Findings 2026)

• OrcaJack: Hijacking Agent Orchestration in Open Multi-Agent Systems (Li et al., Findings 2026)

ACL

• Xiang Li, Haining Yu, Wenbo Pan, Hongli Zhang, and Xiaohua Jia. 2026. OrcaJack: Hijacking Agent Orchestration in Open Multi-Agent Systems. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 35911–35929, Budapest, Hungary. Association for Computational Linguistics.