How do failures cross boundaries between multiple agents?
Explores four distinct mechanisms—messages, shared state, aggregation, and delegation—that allow a failure or attack originating in one principal to propagate through multi-agent systems. Understanding these pathways is essential for designing agent interactions that contain rather than amplify risk.
The introduction packs the mechanism into one sentence: "Messages propagate influence between principals, a shared state preserves propagated influence, aggregation combines local outputs from different principals, and delegation transfers authority across boundaries." Each verb is a different thing an interaction can do to a failure. A message moves influence from one principal to another. Shared state lets the influence outlast the exchange, so a later principal inherits what an earlier one absorbed. Aggregation merges local outputs, so a wrong or manipulated contribution can carry into a group result. Delegation moves authority rather than information, which is what lets attacker content reach a privileged tool.
This differs from the inventory in Do internal agent hops in pipelines need security monitoring?. That note counts five arrows in one pipeline shape, so it is a list by position. The four verbs are a list by mechanism and do not depend on the topology. Two of them are not hops at all: aggregation is a combination step and shared state is a place, and the vault note on that inventory observes it has no peer-to-peer hop, which is the "messages" case in Can one compromised agent corrupt an entire multi-agent network?.
The vault already holds an instance of most verbs. Shared state: Can ordinary infrastructure become unplanned agent memory? and Can shared agent memory systems reliably delete information?. Aggregation: Can a quorum of honest validators certify an invalid transition? and Does confidence drive influence in multi-agent deliberation systems?. Delegation: the path a taint travels in Can semantic labels on requests prevent malicious propagation through agent networks?. Those mappings are my reading, not the paper's.
A caution on scope. The abstract separately counts "six interaction interfaces", and the excerpt does not say how the four verbs relate to them: a subset, a coarser cut, or an independent one. Treat the verbs as the introduction's own summary of mechanism, not as the interface taxonomy (see Can adversary position unify fragmented multi-agent attack models?).
What the excerpt does not give. No examples per verb, no ranking of which mechanism dominates, and no mapping to the six interfaces.
Inquiring lines that read this note 44
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How does misalignment propagate through agent communication networks?- How did agents rebuild communication after Hugging Face removed the channel?
- How do shared state and message propagation transfer failure across agent boundaries?
- How does pipeline position amplify failures between monitored agents?
- What interventions prove causation in multi-agent message propagation studies?
- What mechanisms let later agents inherit information left by earlier ones?
- Why do agents rebuild communication after channels are removed?
- What routes do different peer mechanisms use to change agent behavior?
- What attacks are unique to multi-agent systems compared to single agents?
- What makes agent-to-agent messages in multi-agent systems vulnerable to exploitation?
- What failure modes emerge when agents operate across organizational boundaries?
- Which agent properties like state retention enable supply-chain and credential vulnerabilities?
- What baseline comparison shows whether interaction actually caused multi-agent failures?
- How do agent-to-agent messages bypass defenses on downstream principals?
- What are the four mechanisms that carry failures across agent boundaries?
- Why do multi-agent failures arise through interactions local checks miss?
- How does insider threat differ from external attack in multi-agent systems?
- What vulnerabilities emerge at each hop between agents in a pipeline?
- Does quarantining state count as recovery in multi-agent attack scenarios?
- What makes the Telephone Loop attack specific to agent delegation?
- Which message channels between agents in pipelines lack input validation?
- Do per-hop channel monitors miss coordinated attacks across multiple message transfers?
- Where does an agent's risk come from across its components and sequence?
- What does error recovery look like across different agent architectures?
- Can semantic audit layers attribute failure mechanisms to infrastructure-level state changes?
- Which eleven failure modes emerge from agentic layers in realistic deployment?
- Does one agent crossing a boundary change what later agents are willing to do?
- What makes an advisory instruction fail when a task is split across agents?
- Does delegation transfer authority or merely distribute work across agents?
- Does the same transfer between agents violate different policies differently?
- Can a shared audit record settle which policy governed a delegation step?
Related concepts in this collection 4
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Do internal agent hops in pipelines need security monitoring?
Multi-agent systems route data between planner, worker, verifier, and synthesizer components. Current defenses only guard user input at the entry point, leaving inter-agent channels unmonitored—but is this a real vulnerability or does downstream safety suffice?
complements: a positional inventory of one pipeline, where this is a pipeline-independent mechanism cut
-
Can individually safe agents fail when working together?
When multiple AI agents interact—sharing information, state, and authority—do failures emerge that local safety checks alone cannot catch? This matters because system-level safety depends on understanding how principals interact.
the thesis these four mechanisms serve
-
Why do single-message classifiers miss cross-agent harms?
Can prompt classifiers detect malicious intent when harm emerges only across multiple agent interactions? The question reframes security from checking individual messages to tracking how content flows and transforms through a multi-agent system.
the flow framing of the same movement of influence and authority
-
Can agents be tricked into delegating work in circles?
A novel attack in multi-agent systems may exploit delegation between agents to create cyclical task loops. The attack's real-world impact and success rate remain unclear from current research.
an attack on the delegation verb with no result in its excerpt; whether the loop transfers authority or only redirects work is not stated
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- LLMs Corrupt Your Documents When You Delegate
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agents
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Why Do Multi-agent LLM Systems Fail?
- Agents of Chaos
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
Original note title
messages propagate influence, shared state preserves it, aggregation combines local outputs and delegation transfers authority — four ways interaction carries a failure across principal boundaries