If you hard-wire every step an AI team takes, does that shut out attackers, or just move the danger?

This explores whether hard-wiring a multi-agent workflow (fixed steps, fixed hand-offs) removes the risk of an attacker steering the planning stage. The corpus has no study that tests fixed pipelines head-on, but it says a lot about what they would and wouldn't fix.

The planning-time attack is real. FlowSteer shows that a crafted prompt can bias how a planner-executor system forms its workflow, raising malicious success by up to 55 percent. It works because the contamination enters upstream of the defenses that inspect workflows Can prompts alone reshape multi-agent workflows without system access?. If the workflow shape is fixed in advance, that specific lever goes away, because there is no free-form plan for a prompt to bend. The same logic plausibly covers the Telephone Loop, an attack that weaponizes cross-agent delegation to form task cycles Can agents be tricked into delegating work in circles?. A pipeline that can't delegate sideways or backwards can't be looped. That part is my inference, since the note doesn't test it.

A fixed shape does nothing about what flows through it. Even in a planner→worker→verifier→synthesizer pipeline, five internal hops (planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer) get no defensive inspection, because existing defenses watch only user input Do internal agent hops in pipelines need security monitoring?. So the attack surface shifts from how the plan is formed to what the plan and tool results contain. Splitting work into specialized roles is also a vulnerability in itself. Harmful intent can be cut into steps that each look benign, with harm appearing only when they are composed Can task decomposition hide harmful intent across agents?. A fixed pipeline still decomposes tasks, and its predictable structure may make that easier for an attacker to exploit.

The corpus points to two other defenses. One is keeping risk information attached as work moves. SafeFlow attaches semantic taints to the root request and lets every downstream step inherit them, restoring the intent that fragmentation strips out Can semantic labels on requests prevent malicious propagation through agent networks?. The other is limiting what an agent can reach. A filter on a single output can't contain an agent with memory, tools, and environment access, so containment means controlling what it can touch Can a model-level filter truly contain an agent with environment access?. The counter-swarm doctrine makes this practical by constraining shared resources and preserving relationships across executions How can operators stop coordinated agent intrusions now?.

So a fixed pipeline shrinks one attack surface, plan formation, and trades it for unmonitored internal hops and composition attacks. It removes an attack path but doesn't eliminate the risk. It works best as one layer alongside intent tracking and access limits.