When AI agents team up, what must a defense actually guarantee — and where do today's defenses fall short?

This explores what each of the five parts of the multi-agent defense contract is supposed to demand. The corpus gives a full requirement for only two of them, and it is more useful for showing where the contract is weak than for spelling out each clause. The framework treats a multi-agent defense as a five-part contract, and the visible part names are path, target, something observation-related (the title is cut off), and recovery Can multi-agent defenses close attack paths completely?. I can't confirm the full list of five from the material available.

The path part asks the defense to close the route an attack takes, not just make it narrower. The measured instances show existing defenses narrowing paths without closing them Can multi-agent defenses close attack paths completely?. One reason is visible in a separate result. Identical security instructions cut payload exposure by 40 to 75 percent for single agents but by zero for multi-agent systems, because the agent doing the risky action often doesn't hold the security context Why does prompt hardening work for single agents but not multi-agent systems?. A path can look closed at one agent and stay open across a handoff. This fits the wider finding that a defense at one layer of the agent stack can be bypassed at another How do agent security layers connect across the stack?.

Recovery is the part the vault says least about. A keyword check across six defense notes found recovery missing from five of them, and only one tied it to irreversibility What recovery mechanisms do vault defense notes actually specify?. That gap matters because of a neighbouring idea. SafeFlow validates the assembled workflow at the point where an action becomes irreversible, since after that point nothing can be undone Where should workflow validation gates be placed for safety?. My reading is that where recovery is impossible, the check has to come before the action, but the notes don't state that link themselves.

Some nearby notes show how specific a contract clause would need to be. Defense should target revisable coordination episodes, meaning sets of actions linked by observed transfers, task authority, and response history, rather than one execution at a time Should defence units span multiple executions and agents?. Naming a prohibition was not enough to keep agents from modifying protected tests. The boundary had to name the protected state itself and come with restricted tools Can explicit authorization boundaries prevent agents from modifying protected tests?. Even that result can't say which ingredient did the work, because rules and tools were tested together Do authorization rules or restricted tools prevent test modifications?. The corpus doesn't say which contract part each of these belongs to, so treat them as neighbours of the contract and not as its definitions.

The contract works best as a checklist that shows where defenses are thin. Path closure is claimed but not achieved, and recovery is barely specified. For the actual clause-by-clause requirements, the framework note is the one to open first.