Can a bad actor slip past AI safety checks by chopping a harmful plan into harmless-looking pieces?

This explores whether splitting a harmful goal into small pieces across agents or steps lets it get past safety checks that only look at one piece at a time. The corpus says yes, and the cause is the same design that makes multi-agent systems useful. Splitting work and giving each agent a specialty means each step can look benign on its own, while the harm only shows up when the steps are put together (Can task decomposition hide harmful intent across agents?).

An attacker can also tune the pieces deliberately. The ColluSkill work plans a chain of skills and then uses scanner feedback to polish each skill until it looks innocent. It reaches 96% average attack success across six scanners (Can attackers evade skill scanners by refining individual skills?). Scanners score skills one at a time, so each round of feedback lowers the suspicion on a single skill while the meaning of the whole chain stays intact. The problem isn't only that fragments look harmless. The checker inspects a smaller unit than the one the attack works at.

The proposed fixes change what gets inspected. One line of work says the unit of defence should be a coordination episode. That is a set of actions linked by observed transfers, task authority and response history, and membership gets revised as evidence comes in (Should defence units span multiple executions and agents?). That work argues that reviewing each execution in isolation throws away the context that spans several executions. The other fix carries the intent forward instead of reconstructing it. SafeFlow attaches semantic labels to the original request and passes them along as work is delegated, so every downstream step inherits the intent and risk context that fragmentation would otherwise strip away (Can semantic labels on requests prevent malicious propagation through agent networks?). The first approach links pieces back together after the fact. The second stops them from ever being separated.

A related idea comes from a different problem, reward hacking in benchmarks. BenchShield doesn't pattern-match individual suspicious events. It checks whether a run's whole trajectory deviates from an intended lifecycle (Can a finite lifecycle model detect reward hacking across benchmarks?), and it separates tasks that merely expose an exploit from runs that actually use one (Can runtime instrumentation distinguish hacking exposure from actual exploitation?). That isn't adversarial multi-agent intrusion, but it points the same way: the evidence sits in the structure of the sequence, not in any single step. The retrieved notes don't test whether taints or episode-based defences hold up against an attacker who adapts the way ColluSkill does, so that question is still open.