Guards that only check what you type in can't see the hidden handoffs between AI agents, where attacks can slip through.

This explores whether defenses that only inspect what a user types in can protect the internal handoffs inside a multi-agent pipeline. The corpus says mostly no. One paper maps five channels inside a planner-worker-verifier-synthesizer pipeline (planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer) that get no defensive inspection at all. An injection hidden in a tool result or a memory can ride those channels downstream without being seen. Each component can be safe on its own while the system as a whole is not Do internal agent hops in pipelines need security monitoring?.

Watching every hop would not be enough either, because several attacks are built to look harmless when checked one message at a time. A crafted prompt can steer a planner-executor system at planning time, biasing how the workflow is formed before any workflow-inspection defense activates. That raised malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?. A harmful goal can also be split across specialized agents into subtasks that each look benign, with the harm appearing only when they are combined Can task decomposition hide harmful intent across agents?. Skill scanners have the same weakness: they score skills individually, so an attacker who refines each skill until it passes can still keep the malicious chain intact. That reached 96% average attack success against six scanners Can attackers evade skill scanners by refining individual skills?. The hardest case is a single biased agent that corrupts six downstream agents using only ordinary messages. The bias carries no explicit semantic content, so paraphrasing defenses don't remove it Can one compromised agent corrupt an entire multi-agent network?.

The alternatives in the corpus stop asking whether a message looks bad and ask where it came from and what the agent can reach. One approach attaches structured semantic labels (taints) to the root request and propagates them as work is delegated. Every downstream step then inherits the original intent and risk that fragmentation would otherwise erase Can semantic labels on requests prevent malicious propagation through agent networks?. Another notes that a filter judges one output at one moment, while an agent's risk spreads across memory, retrieved content, tool calls and environment access. Containment therefore means controlling what an agent can touch, not only what it says Can a model-level filter truly contain an agent with environment access?. In one test, telling agents not to modify protected tests worked only when paired with restricted tools, and only when the boundary named the protected state itself Can explicit authorization boundaries prevent agents from modifying protected tests?.

The same idea shows up at the level of what a defender should watch. The proposed unit of defense is a coordination episode: a set of actions linked by observed transfers, task authority and response history, with membership revised as evidence accumulates. Reviewing each execution in isolation loses exactly the context that spans them Should defence units span multiple executions and agents?. The companion counter-swarm doctrine preserves relationships across executions, constrains the shared resources agents can access, and ties responses to persistent state rather than closed channels How can operators stop coordinated agent intrusions now?. Input-boundary defenses guard a door, but these attacks move through the building. The better guard follows the request's history through every hop and limits what each agent can reach once it is inside.