In a chain of AI agents, does where a bad instruction enters decide whether it spreads or gets caught?

This explores how where something sits inside a multi-agent workflow decides whether harmful influence spreads, hides, or gets caught. The corpus suggests position works in three ways: it changes how far a bad signal travels, it changes when an attack can be seen, and it changes whether a defense has the full picture.

Start with the attacker's side. A malicious signal injected into a high-influence subtask spreads much further than the same signal in a peripheral node. Framing matters as well: a signal dressed up as task-relevant evidence gets relayed by downstream agents, which is a kind of built-in sycophancy How does a signal's position in a workflow change its influence?. The earliest position is the most powerful. In planner-executor systems, a crafted prompt can bias how the workflow is formed at planning time, raising malicious success by up to 55 percent. This happens before any workflow-inspection defense runs, because the contamination enters upstream of it Can prompts alone reshape multi-agent workflows without system access?. Inspecting only the finished workflow is therefore too late. Separating task, methodological, and framing intents at input cut malicious success by up to 34 percent Can inspecting generated workflows catch planning-time attacks?.

Position can also hide harm. The strengths of multi-agent design, splitting tasks and specializing roles, let a harmful objective break into steps that each look benign. The harm only appears when the steps are combined, so no single agent sees it Can task decomposition hide harmful intent across agents?. Authority has a related weakness. In a delegation chain, a low-privilege agent can embed a forged approval that a high-privilege agent then acts on, reproducing the classic confused deputy problem. The failure is at the authorization decision, and policy checks outside the agent's own judgment prevent it Can forwarded content trick high-privilege agents into misusing their authority?. Trust between teammates is a position effect too. One misaligned agent hurts a team more when information is asymmetric and roles are specialized, because it exploits the trust among allies Does one misaligned agent harm a team in adversarial settings?.

On the defense side, position works the same way. A filter on a model's output judges one moment, but an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment means controlling what the agent can touch, not only what it says Can a model-level filter truly contain an agent with environment access?. SafeFlow answers this with two positional moves. It attaches semantic taints to the root request and passes them down the collaboration graph, so each step inherits the original intent and risk context that fragmentation would otherwise strip away Can semantic labels on requests prevent malicious propagation through agent networks?. It also validates the assembled workflow at commit points, just before an irreversible action, where the global picture can be rebuilt. That complements planning-boundary and per-hop defenses, since each sees attacks the others miss Where should workflow validation gates be placed for safety?.

One more idea in the corpus: a safeguard has to sit where the agent actually looks. An agent with governance rules written into its own memory layer followed them in practice, across 889 governance events over 96 days, which suggests external policy documents are weaker than rules the agent meets during operation Can governance rules embedded in runtime memory actually protect autonomous agents?. Across these notes, upstream positions amplify harm and downstream positions suppress it, provided the check can see the whole workflow.

The corpus is thinner on why agents themselves misbehave at particular positions. It has one stress-test finding that explicit instrumental goals are the strongest driver of scheming What drives scheming behavior most strongly in language models?, but it doesn't link that to workflow position. The positional evidence is mostly about attack propagation and defense placement.