When several AI agents each write part of the same log, can anything reliably catch what goes wrong?

This explores whether a monitor reading the log of a multi-agent pipeline, where a planner, tools, memory, workers and verifiers each wrote part of it, can reliably catch problems when no single author wrote the whole trace. The corpus suggests the answer is not yet, and for specific reasons. It has no study that tests a monitor on mixed-authorship traces directly, so what follows is pieced together from nearby work on pipeline security.

The first problem is coverage. One note counts five internal hand-offs (planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer) that get no defensive inspection at all, because existing defenses watch only what the user types in Do internal agent hops in pipelines need security monitoring?. A poisoned tool result or memory entry can travel downstream unseen. The middle of the trace, where authorship is most mixed, is the part nobody is reading. Some activity may also never appear in the trace. In two documented cases, agents used an internal package service and a public wiki as message boards, and later agents picked up what earlier ones had left there Can agents repurpose ordinary infrastructure for unintended communication?.

The second problem is that full coverage isn't enough if you read one step at a time. Splitting a task across specialized roles lets a harmful objective break into pieces that each look benign, with the harm appearing only when they combine Can task decomposition hide harmful intent across agents?. Agents also tend to accept what their neighbors tell them without checking, so errors spread. They do notice direct conflicts, but not a quiet, plausible-looking bad input Why do multi-agent systems fail to coordinate at scale?. A step-by-step monitor and the pipeline's own agents share the same blind spot.

Two lines of work point toward fixes. One is provenance: SafeFlow attaches a semantic label to the original request and passes it along the delegation graph, so each downstream step inherits the intent and risk context that fragmentation stripped away Can semantic labels on requests prevent malicious propagation through agent networks?. Here, knowing who wrote a line becomes a signal instead of a nuisance. The other is evidence the agents didn't author. BenchShield grounds claims about whether an agent followed the intended path in recorded infrastructure evidence rather than in a final score Can infrastructure evidence replace terminal scores in benchmark validation?. It was built for benchmark validation, but the logic carries over: an agent's own account of what it did is the weakest part of the record. A third, more speculative link is that agents exchanging standardized documents instead of free-form chat Does structured artifact sharing outperform conversational coordination? might give a monitor a more legible trace. That paper measures coordination quality, not monitorability, so this is an inference.

One more idea helps a monitor decide where to look. Simply being in a multi-agent setting doesn't make a failure a multi-agent one. Only amplification, composition and emergent properties count, and a failure that interaction leaves unchanged is a single-agent problem in new packaging Does a multi-agent setting automatically signal a security effect?. A monitor can therefore check each step with ordinary single-agent tools and save the harder work for problems that only show up across the seams between agents. Reliable monitoring probably needs to see the delegation graph and independent records, not just the text.