When one AI agent in a team makes a mistake, what are the four ways it spreads to the others?

This explores the four ways a problem in one AI agent can spread to other agents in a multi-agent system, and why those four channels matter more than how the agents are wired together. The corpus gives them as four verbs: messages propagate influence between agents, shared state preserves it over time, aggregation combines local outputs that may already be corrupted, and delegation transfers authority across boundaries How do failures cross boundaries between multiple agents?. Each one works independently of pipeline topology, so a simple chain of agents and an elaborate web can both fail through the same channels.

You can think of each verb as a different kind of contamination. A message is a one-off push: one agent's mistaken or manipulated claim shapes what the next one does. Shared state, such as memory or a common scratchpad, lets that bad influence outlast the conversation that created it. Aggregation is the vote or merge step, where several outputs are combined and one corrupted input can taint the result. Delegation is the most dangerous, because it hands over authority as well as information, so a compromised agent can lend its permissions to another one. A systematic review of 197 works finds that this is why agents that pass individual safety checks can still cause harm together: the risk sits in the unmonitored interactions between them, not in any single agent Can individually safe agents fail when working together?.

The corpus also warns against reading too much into the label "multi-agent". Running several agents together doesn't by itself prove a new security problem exists. An interaction can leave a failure unchanged, in which case it's really a single-agent problem in a new setting. It can amplify a failure, create one through composition, or define a new property that only exists at the group level. Only the last three count as genuinely multi-agent effects Does a multi-agent setting automatically signal a security effect?. That gives you a test for any claimed multi-agent failure: which of the four channels carried it, and did the crossing change anything?

The result is that harm can land on people who never saw it coming. Failures in delegated workflows can reach parties who neither wrote the original prompt nor watched the workflow run, which breaks oversight designs that assume the requester, the observer and the affected person are the same Who actually bears the risk when multi-agent workflows fail?. When a chain of delegation crosses organizational lines, the corpus notes that nobody is named as owning the rules for the whole trajectory. The operator, the organization, the regulator and the standards body each have different policies, and these may conflict and may not be visible to everyone involved Who enforces invariants when agents cross organizational boundaries?.

For a wider view of the same problem, one study of 5 frameworks and 150+ tasks found 14 failure modes grouped into specification issues, inter-agent misalignment and task verification Why do multi-agent LLM systems fail more than expected?. The four mechanisms above are best read as the routes those failures travel along, not as a competing list of failure types.