In LLM multi-agent systems, the communication topology — which agents talk to which — is intellectual property. It determines how information flows, how decisions are made, and how the system handles failures. Knowing the topology is knowing the architecture.
WebWeaver extracts the complete topology by compromising a single arbitrary agent (arXiv:2603.11132). Not the administrator. Not a privileged node. Any agent in the network. The attack infers topology from context rather than identifiers — it reads the conversational patterns, information dependencies, and response structures that reveal who communicated with whom.
Two mechanisms are provided. The covert jailbreak-based approach manipulates the compromised agent into revealing its communication partners through carefully crafted prompts. The jailbreak-free diffusion design works when jailbreaks are defended against — it propagates inference signals through the network's normal operation, using the topology itself as the channel for its own exfiltration.
The accuracy is roughly 60% higher than existing approaches under active defenses, with negligible overhead. The attack is stealthy because it uses the system's own communication patterns as evidence. No anomalous traffic, no privilege escalation, no direct probing of other agents.
The vulnerability is structural. Any agent that receives messages from neighbors contains information about those neighbors in its context. The context is the leak. Defending against this requires either preventing agents from retaining communication context (which degrades performance) or making the context uninformative about topology (which requires fundamental changes to how agents process messages).