In a chain of AI agents, does it matter where a bad instruction sneaks in — and can it hide?

This explores how the place where a malicious signal enters a multi-agent workflow changes how far it spreads and whether defenses notice it. The corpus gives a two-part answer. Position controls how far a signal travels, and it also controls how visible the signal is.

Start with reach. In an attack called FLOWSTEER, a malicious signal injected into a high-influence subtask spreads far more than the same signal placed in a peripheral node. Framing matters as much as location. If the signal is dressed up as task-relevant evidence, downstream agents relay it as though it were useful context How does a signal's position in a workflow change its influence?. Agents that trust their teammates pass along whatever looks like help, and misalignment can exploit that trust rather than break any expectation Does one misaligned agent harm a team in adversarial settings?. So a peripheral, oddly framed signal mostly dies out, while an upstream, evidence-shaped one gets amplified.

The most powerful position is the earliest one. A crafted prompt can bias how a planner builds the workflow before any tools run, and this raised malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?. This also explains why the obvious defense fails. Checking the generated workflow happens after the contamination is already baked in Can inspecting generated workflows catch planning-time attacks?. An input-side defense that separates the task, the method, and the framing in an instruction cut malicious success by up to 34 percent, because it works at the point where the instruction is organized.

Position can also hide a signal. Splitting a task across specialized agents is the main strength of multi-agent systems, but a harmful goal can be spread across steps that each look benign, so the harm only appears when they are combined Can task decomposition hide harmful intent across agents?. Skill scanners show the same pattern. They score each skill on its own, so an attacker can use scanner feedback to blunt each piece while the chain as a whole still does the job, reaching 96% average attack success Can attackers evade skill scanners by refining individual skills?. The structure that lets a signal travel is the same structure that keeps any single checkpoint from seeing all of it.

The defenses in the corpus each target a different position. One validates the assembled workflow at the point just before an irreversible action, rebuilding the risk picture that no single step holds Where should workflow validation gates be placed for safety?. Another attaches semantic labels to the original request and passes them down the chain, so later steps inherit the original intent and risk Can semantic labels on requests prevent malicious propagation through agent networks?. These complement planning-boundary and per-hop checks, and each catches attacks the others miss. Once agents are connected to tools and credentials, the response workflow around them also becomes part of what needs securing Should response workflows be inside the security boundary?. The corpus has one direct study of position-dependent amplification. Most of the rest is about defenses, and it says little about how much of the effect comes from position versus framing.