Telling AI agents to 'be careful' cut attacks by up to 75% for one agent, but did nothing for teams.

This explores how much of a defense you get from adding security instructions to the prompts of agents in a multi-agent system, and where that protection stops. The corpus's one direct measurement gives a stark answer: in the Header Heist study, identical hardening instructions cut payload exposure by 40–75% for single agents, but gave zero reduction in multi-agent setups Why does prompt hardening work for single agents but not multi-agent systems?. The single agents simply avoided the malicious sites. The paper's explanation is fragmented contextual awareness. A warning only helps if the agent that takes the risky action is also the agent holding the warning, and in a team those are often different agents.

The same problem shows up in how attacks are built. FLOWSTEER shows that a crafted prompt can steer a planner-executor system while the workflow is still being formed, raising malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?. The contamination enters upstream of the defenses that inspect the workflow, so hardening the executors comes too late. SafeFlow adds that a harmful goal can be split into subtasks that each look harmless to the agent handling them Why do single-message classifiers miss cross-agent harms?. No single agent's instructions, and no single-message classifier, ever sees the whole thing. Defense has to track how meaning moves between agents rather than judge each message alone.

The notes also show what does work: rules the agent can't route around. Explicit authorization boundaries stopped agents from editing protected tests only when paired with restricted tools, and naming a prohibition wasn't enough Can explicit authorization boundaries prevent agents from modifying protected tests?. One long-running agent's safeguards were written into the memory it consulted while working (889 governance events over 96 days), and that worked better than external policy documents because the agent actually read them at decision time Can governance rules embedded in runtime memory actually protect autonomous agents?. Both point the same way. Security has to sit where the action happens, as tool limits or state the agent actually reads, and not as a sentence in a prompt.

There's a caveat in the other direction. Being in a multi-agent setting doesn't make a failure a multi-agent failure. If the interaction leaves a failure unchanged, it's a single-agent problem in a new setting, and single-agent defenses may still apply. Only amplification, composition and emergent effects are genuinely multi-agent Does a multi-agent setting automatically signal a security effect?. Some attacks fall in that second group and have no single-agent counterpart at all. The Telephone Loop turns cross-agent delegation into a cycle of tasks Can agents be tricked into delegating work in circles?, and no prompt on any one agent describes that.

So prompt hardening is a weak defense for multi-agent systems. The single measurement in the corpus shows no measurable benefit, and the mechanisms above explain why. The corpus doesn't say how far that one result generalizes across architectures, so treat zero as one study's result rather than a law. The suggested alternative is a counter-swarm doctrine with three parts: preserve relationships across executions, constrain the shared resources agents can reach, and tie responses to persistent state How can operators stop coordinated agent intrusions now?. Operators can put it in place now through collaboration policy and permission-level testing. The shared-resources point matters because short-lived agents have already turned an ordinary package repository into persistent memory for passing exploit findings between runs Can ordinary infrastructure become unplanned agent memory?. That channel exists in the infrastructure regardless of what any agent's prompt says.