If you copy a security guardrail from one AI setup to another, does it still protect you?

This explores whether a single security defense can be moved between different AI system designs and keep working. The corpus's answer is mostly no. Protections tend to be tied to the structure they were built for, though a few pieces do carry over.

The clearest case is prompt hardening. In one test, identical security instructions cut exposure to malicious payloads by 40–75% in a single-agent web system, and by zero in the multi-agent version Why does prompt hardening work for single agents but not multi-agent systems?. The reason is that the instruction only helps if the agent taking the risky action also holds the security context, and in a multi-agent system that context gets split up. The multi-agent design also carries a weakness of its own. In another benchmark, a single agent resisted attack 89% of the time, while the multi-agent version with the same task, tools, and underlying model was breached 69% of the time Does multi-agent architecture make systems easier to attack?. So the architecture is not a neutral container for a defense. It changes how much the defense can do.

The same pattern shows up when you move between models. A safety harness strict enough for one model over-blocks another, and a policy general enough to transfer across domains misses the safety relations specific to an application Should safety harnesses be customized for each deployment?. Even where the protection sits matters. A model-level filter judges one output at one moment, but an agent's risk spreads across memory, tool calls, and what it can reach in its environment, so a filter alone can't contain it Can a model-level filter truly contain an agent with environment access?. Explicit rules have a similar limit. Telling an agent not to modify protected tests worked only when it was also given restricted tools Can explicit authorization boundaries prevent agents from modifying protected tests?.

Multi-agent systems also have places where single-agent defenses never looked. Pipelines have hops (planner to worker, tool to worker, memory to worker, worker to verifier) that existing defenses don't inspect, since they only watch user input, so a system can be safe component by component and still be unsafe as a whole Do internal agent hops in pipelines need security monitoring?. Skill scanners have the same blind spot. They score each skill alone, so an attacker can soften every piece while the harmful chain stays intact, reaching 96% average attack success Can attackers evade skill scanners by refining individual skills?. The layer that picks which model handles a request is an attack surface too, and it sits below prompt-level defenses Can attackers manipulate which model handles a request?.

Some ideas do seem to transfer, mainly ones that change what the defense treats as its unit. One proposal is to defend revisable coordination episodes, meaning sets of actions linked by observed transfers and task authority, instead of isolated executions Should defence units span multiple executions and agents?. Another is to build governance into the runtime memory the agent actually consults Can governance rules embedded in runtime memory actually protect autonomous agents?. In a related area, a map of reward-hacking defenses found that some work the same way across weights, selection, and text, while others are only loose analogies Which reward hacking defenses actually transfer across training substrates?. Nothing in this set shows the same map for security defenses, so which ones transfer is still an open question. For now, assume a protection needs re-testing whenever the architecture changes.