Even if every AI agent in a chain is safe alone, a poisoned message passed between them can slip through unchecked.

This explores why a message from one AI agent can slip past the safety checks meant to protect the next agent in line, and what actually stops it. The short answer is that most defenses guard the front door, and agent-to-agent traffic goes through side doors. In a typical planner → worker → verifier → synthesizer pipeline, five internal channels (planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer) get no inspection at all. Existing defenses watch only what the user types, so an injection hidden in a tool result or a memory entry travels downstream unchecked (Do internal agent hops in pipelines need security monitoring?). Each agent can be safe on its own while the system as a whole is not.

The message doesn't even have to look malicious. In one study, a single biased agent passed persistent behavioral corruption through six downstream agents using only ordinary conversation. Paraphrasing defenses failed because the bias never appeared as explicit content that could be filtered or reworded (Can one compromised agent corrupt an entire multi-agent network?). Messages are also only one of four routes. Shared state keeps influence around over time, aggregation folds corrupted outputs into a combined result, and delegation hands authority across boundaries. These routes work regardless of how the pipeline is wired (How do failures cross boundaries between multiple agents?). The attack can also arrive early. A crafted prompt can steer how a planner assembles the workflow, which contaminates everything before workflow-inspection defenses run and raised malicious success by up to 55 percent (Can prompts alone reshape multi-agent workflows without system access?).

The most instructive case is authority. In a retrieval → summarization → delegation chain, a low-privilege agent can embed a forged approval claim in the content it forwards. The high-privilege agent then uses its own legitimate powers to do something it shouldn't, which is the classic 'confused deputy' problem. The defenses on the executing agent never get a chance to fail, because the mistake happens earlier, at the moment someone decides the action is authorized (Can forwarded content trick high-privilege agents into misusing their authority?). This is also why filtering what a model says doesn't contain it. A filter judges one output at one moment, while an agent's risk lives in its memory, retrieved content, tool calls, and reach into the environment (Can a model-level filter truly contain an agent with environment access?).

The fixes in the corpus share one idea: don't rely on the receiving agent's judgment. Authorization checks can sit outside the agent as external policy, which is what prevented the confused-deputy failure (Can forwarded content trick high-privilege agents into misusing their authority?). Risk labels can travel with the request instead of being lost as work gets split up. SafeFlow attaches semantic taints to the original request and propagates them through the collaboration graph, so each downstream step inherits the original intent (Can semantic labels on requests prevent malicious propagation through agent networks?). Rules also need to name the protected thing itself and be backed by restricted tools. In one test, a stated prohibition on modifying protected tests held only when the agent's tools were also limited (Can explicit authorization boundaries prevent agents from modifying protected tests?). In practice this means treating every message from another agent as untrusted input, however friendly the sender.