Security checks on each step of an AI pipeline may catch nothing if the attack quietly skews the plan first.

This explores whether security checks placed at individual stages of a multi-agent pipeline can catch an attack that quietly skews the planner's decisions before any stage has something to inspect. The corpus says they largely can't, and it gives two separate reasons.

The first is timing. An attack called FLOWSTEER shows that a crafted prompt can steer a planner-executor system by biasing how the workflow gets formed, before any infrastructure is invoked. That raised malicious success by up to 55 percent, and it works because the contamination enters upstream of the defenses that inspect workflows (Can prompts alone reshape multi-agent workflows without system access?). A defense that looks only at the finished workflow arrives after the damage is done. The one mitigation the corpus reports moves the check earlier, to the instruction-organization boundary. It separates the task, methodological, and framing intents in the input, and it cut malicious success by up to 34 percent, so it helps but doesn't close the gap (Can inspecting generated workflows catch planning-time attacks?).

The second reason is that per-hop gates barely exist yet. In a planner→worker→verifier→synthesizer pipeline, five internal channels (planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer) get no defensive inspection at all, because current defenses watch only the user's input. An injection in a tool result or in memory can therefore travel downstream unseen (Do internal agent hops in pipelines need security monitoring?). Adding a gate at every hop would fix the missing-coverage problem. It would not fix the timing problem, because a biased plan looks like an ordinary plan by the time it reaches a hop.

Other notes suggest why even well-placed per-hop checks struggle. Stateless per-action checks structurally can't express constraints that depend on history, and only monitors that track behavior across the whole sequence can catch actions that are each allowed but together violate a safety rule (Can stateless checks ever catch sequence-level constraint violations?). Skill scanners show the same weakness. They score each skill on its own, so an attacker can use scanner feedback to make every piece look innocent while the chain-level intent stays intact, reaching 96% attack success (Can attackers evade skill scanners by refining individual skills?). Bias can also pass between agents without any suspicious content. One compromised agent corrupted six downstream agents through ordinary messages, and neither detection nor paraphrasing removed it because the bias carries no explicit semantic content (Can one compromised agent corrupt an entire multi-agent network?).

The corpus points to a common remedy, which is to make the unit of defense larger than a hop. That means treating a set of actions linked by observed transfers, task authority, and response history as one revisable coordination episode, because isolated review loses context that spans executions (Should defence units span multiple executions and agents?). One caveat: the evidence is direct for gates that inspect generated workflows and indirect for per-hop gates in general, since no note here tests a fully instrumented set of hop-level gates against planning-time bias.