Why can an attack that passes tasks around in circles only happen when AI agents work as a team?

This explores why the Telephone Loop counts as its own kind of attack that only exists when agents hand work to each other, rather than an old attack like prompt injection aimed at a team of agents. The corpus's answer is that the raw material of the attack is delegation itself, and a cycle can't form with fewer than two agents.

The Telephone Loop Can agents be tricked into delegating work in circles? weaponizes cross-agent delegation to form task cycles, so work gets passed along and ends up circling back, like the children's game. The research separates it from "applying existing attacks like prompt injection to teams." A single agent can be injected, but it can't delegate in circles because it has no one to hand work to. That is why the note describes the mechanism as having no single-agent counterpart.

Delegation is a special kind of link between agents. One framework How do failures cross boundaries between multiple agents? names four ways failures cross between agents: messages carry influence, shared state preserves it, aggregation combines possibly corrupted outputs, and delegation transfers authority. The Telephone Loop is built on that last one. Compare it with subliminal prompt injection Can one compromised agent corrupt an entire multi-agent network?, which uses the first one. There, a single biased agent corrupts up to six downstream agents through ordinary messages, and the harm is content that flows one way down the chain. In the loop, what gets exploited is where the work is routed. Delegation chains have another known weak point, the confused deputy problem Can forwarded content trick high-privilege agents into misusing their authority?. There a low-privilege agent forges an approval and a high-privilege agent misuses its real authority. Both attacks target the handoff, but the confused deputy forges a claim at one handoff, while the loop exploits the pattern formed across several.

That cross-agent shape may explain why it's hard to see. This part is my inference from the notes, not something they state. A model-level filter judges one output at one moment Can a model-level filter truly contain an agent with environment access?. Each hop in a loop could look like a reasonable delegation, and the cycle only shows up across agents and over time. The counter-swarm doctrine How can operators stop coordinated agent intrusions now? points the same way. Its defenses preserve relationships across executions and tie responses to persistent state rather than closed channels, which is the sort of memory you'd need to notice a task coming back to where it started. FLOWSTEER Can prompts alone reshape multi-agent workflows without system access? is another team-only attack. It biases how a planner forms the workflow before any defenses run. Together they suggest the attack surface in multi-agent systems is the coordination structure, not only the models.

The retrieved notes don't spell out the Telephone Loop's payoff or a defense designed specifically for it. What they establish is the structural point: it needs delegation between multiple agents to exist at all.