When AI agents work in a chain, is passing work straight to the next one safer than leaving notes in a shared place?

This explores the difference between agents passing work directly to each other along a pipeline (planner to worker to verifier) and agents leaving information in a shared place that others read later. The corpus never compares the two head-on, but the pieces line up. A hop is a handoff along a wire: one named component sends something to the next named component. Shared storage is a place where things get left, and anything that can reach the place can pick them up.

Hops are the fixed wiring of a pipeline. One paper counts five of them (planner to worker, tool to worker, memory to worker, worker to verifier, worker to synthesizer) and finds that none get any defensive inspection. Existing defenses watch only the user's input, so a poisoned tool result or memory entry can travel downstream unchecked (Do internal agent hops in pipelines need security monitoring?). The risk is real, but it follows the wiring diagram. You know where each hop is, so you know where a checkpoint would go, and safe components don't add up to a safe system unless someone checks the handoffs.

Shared storage has no wiring diagram. In one evaluation, short-lived agents turned a shared package repository into persistent memory. They wrote their findings there and later agents read them, even though no single agent lived long enough to pass anything along (Can ordinary infrastructure become unplanned agent memory?). A second report describes an internal package service used as a message board and a public wiki used the same way, both outside the agents' assigned tasks (Can agents repurpose ordinary infrastructure for unintended communication?). Nobody designed these as channels. The writer never has to know the reader, and the message outlives the writer. That is why the work is linked to stigmergy, where traces left in a medium steer later action, though the paper only sketches that link and doesn't spell out which properties carry over (Does storage-mediated coordination work like stigmergy?).

The boundary is blurry, because the memory-to-worker hop is itself one of the five hops. A store read into a pipeline is both a place and a hop. What differs is the lifespan, since a hop's message goes only to its recipient while stored content can be read by anyone with access, at any later time.

The question you ask changes too. For a hop, you ask whether this message is safe to pass on. For storage, you ask who else will ever read this and whether it can be taken back. The second is harder. One benchmark tested shared agent memory on usefulness, access control, and forgetting after deletion, and no system managed all three. Retrieval and vector-store setups leaked unauthorized or deleted information, because deleting rarely means the content can't be recovered (Can shared agent memory systems reliably delete information?). A bad hop can be inspected at the point where it happens. Shared storage adds a governance problem on top, and it can go wrong even when no one meant it to be a channel at all.