If every AI agent passes inspection on its own, can the group still do something harmful together?

This explores whether checking each agent or each message on its own can ever catch harm that only appears when the pieces combine, and what has to be added. The corpus's answer is that isolated checks mostly can't do it, because the harm isn't in any single piece. Multi-agent systems get their power from splitting tasks and specializing roles. That same feature lets a harmful goal be cut into steps that each look benign, so the harm exists only in the composition Can task decomposition hide harmful intent across agents?. A classifier that reads one message at a time has nothing suspicious to flag, which is why SafeFlow frames this as a problem of tracking meaning as it flows through the system rather than classifying isolated inputs Why do single-message classifiers miss cross-agent harms?.

The same blind spot exists across time as well as across agents. Step-by-step approval can pass every action and still miss a sequence that collectively breaks a constraint, because safety rules bind an agent's whole pattern of behavior, not one move at a time Can step-by-step approval miss harmful behavior patterns?. A filter on a model's output has the same limit: it judges one output at one moment, while the agent's risk spreads across memory, retrieved content, tool calls, and reach into its environment Can a model-level filter truly contain an agent with environment access?. Checking only the end result doesn't fix this. An agent that skips a required verification step can still reach the correct verdict, so outcome monitoring can't tell compliance from cutting corners Can a correct outcome hide protocol violations in multi-agent systems?.

Sometimes the message holds nothing to catch at all. A single biased agent can pass persistent behavioral corruption through six downstream agents using only ordinary messages. Because the bias carries no explicit semantic content, it also survives paraphrasing defenses Can one compromised agent corrupt an entire multi-agent network?. And in a planner-worker-verifier-synthesizer pipeline, five internal channels get no inspection, since existing defenses watch only user input. Each component can be safe while the system as a whole is not Do internal agent hops in pipelines need security monitoring?.

What works is giving each local check the history it lacks. SafeFlow's approach is to attach a structured semantic label to the root request and pass it along the collaboration graph as work is delegated. Each downstream step then inherits the original intent and risk context that fragmentation strips away Can semantic labels on requests prevent malicious propagation through agent networks?. The check is still local, but it now carries the whole chain with it. The other approaches control what an agent can touch instead of judging what it says: constrain shared resources, preserve relationships across executions, and tie responses to persistent state How can operators stop coordinated agent intrusions now?. Rules also need to sit where the agent actually looks. One persistent agent logged 889 governance events over 96 active days with safeguards written into the memory layer it consulted while working Can governance rules embedded in runtime memory actually protect autonomous agents?.

There is a practical catch. Naming a prohibition isn't enough. In testing, explicit boundaries kept protected tests unmodified only when paired with restricted tools, and the boundary had to name the protected state itself Can explicit authorization boundaries prevent agents from modifying protected tests?. Catching composed harm also means keeping a trustworthy record of the process, not just the result. Anchoring cryptographic commitments instead of content gives tamper-evident process records without exposing sensitive traces, though organizations still have to retain the content and answer hard questions about deletion and access Can commitments protect sensitive agent data while enabling verification?.