One Big AI Model or Many Agents? A Security View

For enterprise AI, several small agents that each do one job with limited access can be safer and cheaper than one large model connected to everything. The benefit is not automatic: it comes from giving each agent the least data and power it needs, and it brings more parts to govern.

This article is for leaders choosing an AI architecture. It sets out the security and cost case for splitting AI into scoped agents, the case against, and how to govern either approach.

What is the difference between a single model and many agents?

In a single-model setup, one general model answers every request and is connected to every data source and tool it might need. In a multi-agent setup, separate agents handle separate tasks, such as reading invoices, checking suppliers or drafting replies, and pass work between them. Open-source frameworks such as AutoGen were built to make applications out of agents that talk to each other.

The question for a business is not which is more advanced. It is which one limits harm when something goes wrong.

Are multi-agent systems more secure?

They can be, for one main reason: blast radius. OWASP’s guidance on excessive agency traces the damage done by a misled AI to three root causes: excessive functionality, excessive permissions and excessive autonomy. A single model wired to every system has all three. An agent that can only read invoices, with no ability to send email or move money, has far less to misuse.

This matters because the main attack on AI systems works by feeding them instructions. OWASP ranks prompt injection first among risks for applications built on large language models, and IBM’s Cost of a Data Breach Report 2026 found that prompt injection incidents against organisations' AI led to average losses of USD 5.89 million. If an injected instruction reaches an agent with narrow permissions, it can do less.

The same OWASP entry also warns about the other side: in multi-agent systems, a compromised peer agent is itself a route for attack. Agents that trust each other without checks spread the problem instead of containing it.

Is it cheaper to use many small models?

Often, yes. Many requests are simple and do not need the largest model. The FrugalGPT study tested sending each query to the cheapest model likely to answer it well and escalating only when needed. On the tasks it tested, this matched the performance of the best single model with up to 98% lower cost.

The savings depend on the work. A system that needs deep reasoning on most requests will gain less.

What are the risks of going multi-agent?

• Complexity. More agents mean more connections, more credentials and more places to misconfigure.
• Hype. Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, and warns of “agent washing”, existing chatbots and automation relabelled as agents. It estimates only about 130 of the thousands of vendors claiming agentic AI are real.
• Accountability. When a chain of agents makes a decision, it must still be clear which person answers for it.

How does this help with shadow AI?

Staff use AI whether or not it is approved. Microsoft and LinkedIn’s 2024 Work Trend Index found that 75% of knowledge workers use AI at work and 78% of those users bring their own tools. Analysis: a catalogue of approved, well-scoped agents for common tasks gives people a better option than unapproved tools, and is easier to defend than a ban.

How should you govern AI agents?

The NIST AI Risk Management Framework applies to each agent as much as to the whole system:

1. Govern: give every agent a named owner and a written purpose.
2. Map: record what data and tools each agent can reach, and what happens if it is misled.
3. Measure: test each agent for prompt injection and data leakage before launch and after changes.
4. Manage: grant the least access, require human approval for actions that move money, data or messages outside the company, and keep logs.
5. Start small. Build agents only where the value is clear, and retire those that do not earn their keep.

For the cost of skipping these steps, see Does Cutting AI Governance Really Save Money?. For the risks of agents on personal computers, see Local AI Agents: Private, but Are They Secure?.

Frequently asked questions

Are multi-agent AI systems more secure than one large model?

They can be, if each agent gets only the data and tools its task needs, so a successful attack on one agent reaches less. They are not secure by default: more agents mean more connections to protect and more permissions to manage.

Do smaller models really cost less?

Often. The FrugalGPT study found that routing each query to the cheapest model able to answer it could match the best single model’s performance with up to 98% lower cost, on the tasks tested.

What is shadow AI?

Shadow AI is staff using AI tools their employer has not approved. Microsoft and LinkedIn found in 2024 that 78% of people who use AI at work bring their own tools.

Should every company build AI agents now?

No. Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of costs, unclear value or weak risk controls. Start where an agent clearly adds value.

References

1. OWASP (2025), LLM06:2025 Excessive Agency — Excessive functionality, permissions and autonomy as root causes; covers compromised peer agents in multi-agent systems.
2. OWASP (2025), LLM01:2025 Prompt Injection — Prompt injection, including indirect injection through websites or files.
3. NIST (2023), Artificial Intelligence Risk Management Framework (AI RMF 1.0) — The Govern, Map, Measure and Manage functions.
4. Wu et al. (2023), AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation — An open-source framework for building applications from multiple agents that converse with each other.
5. Chen, Zaharia and Zou (2023), FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance — Model cascades matched the best single model’s performance with up to 98% cost reduction in the experiments reported.
6. Microsoft and LinkedIn (2024), AI at Work Is Here. Now Comes the Hard Part (Work Trend Index) — 75% of knowledge workers use AI at work; 78% of AI users bring their own AI tools.
7. Gartner (2025), Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 — Cancellation forecast and 'agent washing'; Gartner estimates only about 130 of thousands of agentic AI vendors are real.
8. IBM (2026), AI-powered adversaries and the enterprise risk challenge (Cost of a Data Breach Report 2026) — Prompt injection incidents averaged USD 5.89 million in losses.