If each handoff between AI agents is checked alone, can an attack split across several handoffs slip through?

This explores whether monitoring each hop between agents separately can miss an attack split across several transfers. The corpus says yes, and in three different ways. The first is that many hops aren't watched at all. In a planner, worker, verifier and synthesizer pipeline, five internal channels (planner to worker, tool to worker, memory to worker, worker to verifier, worker to synthesizer) get no inspection, because existing defenses only look at user input. An injection hidden in a tool result or a memory entry travels downstream unseen, which shows that safe components don't add up to a safe system Do internal agent hops in pipelines need security monitoring?.

The second way is that adding a monitor to every hop still isn't enough. A harmful goal can be broken into subtasks that each look benign on their own, so a classifier that judges one message at a time has nothing to flag Why do single-message classifiers miss cross-agent harms?. The ColluSkill attack shows how well this works against real tools. Scanners score each skill individually, so an attacker can use scanner feedback to make each piece look less suspicious while the malicious chain still works when the pieces run together. That approach reached about 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?.

The third way is the least intuitive. Sometimes no single message carries anything a monitor could find. One biased agent can pass a persistent behavioral corruption through six downstream agents using only ordinary messages. Because the bias carries no explicit semantic content, it gets past detection and past paraphrasing defenses Can one compromised agent corrupt an entire multi-agent network?. A per-hop monitor also sees only one of the ways failures cross between agents. Messages are one route. Shared state, aggregation of possibly corrupted outputs, and delegation of authority are three more, and none of them depends on the pipeline's shape How do failures cross boundaries between multiple agents?.

The proposed fixes all change what gets watched, from single messages to the relationships between them. One proposal makes the unit of defence a coordination episode: a set of actions linked by observed transfers, task authority and response history, with membership revised as evidence comes in Should defence units span multiple executions and agents?. Another attaches semantic labels to the original request and carries them along as work is delegated, so every downstream step inherits the original intent that fragmentation would otherwise erase Can semantic labels on requests prevent malicious propagation through agent networks?. The counter-swarm doctrine adds two more pieces: constrain the shared resources agents can touch, and tie responses to persistent state instead of closed channels. It also says operators can start on this now through collaboration policy and permission-level testing How can operators stop coordinated agent intrusions now?.