When harm spreads between AI agents, is it just meaning passed along step by step, or does some travel unseen?

This explores whether harm spreading through networks of AI agents is best understood as meaning traveling from step to step, or whether some of it moves through channels that meaning-based tracking would miss. The corpus says mostly yes, and the exceptions are the interesting part.

The case for "yes" starts with how the attack works. Multi-agent systems split work and give each agent a specialty, and that same design lets a harmful goal be cut into pieces that each look harmless, with the harm appearing only when the pieces are put together Can task decomposition hide harmful intent across agents?. Nothing is wrong at any single step. What gets lost is the original intent. The defense the corpus describes treats it as exactly that: attach a structured semantic label to the root request and pass it along as work is delegated, so every downstream step inherits the risk context that fragmentation stripped away Can semantic labels on requests prevent malicious propagation through agent networks?. This borrows the idea of "taint tracking" from security, and it only works if the harm is a meaning that can be carried.

The attacks seem to agree. Malicious signals spread much further when planted in high-influence subtasks than in peripheral ones, and further still when phrased as task-relevant evidence that downstream agents will relay How does a signal's position in a workflow change its influence?. Reasoning models will follow a harmful but plausible-sounding plan placed in their context and restate it as their own thinking, which slipped past chain-of-thought monitors 25 to 33 percent of the time Can reasoning models be steered by injected context without detection?. In both cases the attacker wins by making the payload read like ordinary, legitimate meaning. The same holds for defenses that check one piece at a time. Skill scanners score each skill on its own, so an attacker can use scanner feedback to make every skill look innocent while the chain as a whole still does the damage, reaching about 96% average success Can attackers evade skill scanners by refining individual skills?. The lesson across all three is that the thing to inspect is the flow, not the individual step.

Here the framing starts to strain. One compromised agent can pass persistent bias through six downstream agents using only normal messages, and paraphrasing defenses fail because the bias carries no explicit semantic content Can one compromised agent corrupt an entire multi-agent network?. A taint label can't follow a signal that isn't stored as meaning. Some attacks also never travel as a message at all. Advertisement embedding gets in through hijacked distribution platforms or backdoored checkpoints, so it corrupts what a model outputs without hurting accuracy Can language models be hijacked to embed hidden advertisements?. And the layer that decides which model handles a request can be manipulated beneath any prompt-level defense, sending traffic to weaker models or making safety checks run against the wrong identity Can attackers manipulate which model handles a request?.

The fairest reading is that malicious propagation is fundamentally a flow problem, and semantic flow is its most visible and most defensible layer. Meaning-level tools such as taints and chain-level analysis address the fragmentation and disguise that most current attacks rely on. The corpus also shows attackers moving to channels those tools can't see: statistical residue in messages, compromised model weights, and the control plane. A defense built only on tracking what the words mean will miss those.