Guarding what users type isn't enough when AI agents pass work along behind the scenes — what slips past that front door?

This explores why defenses that only inspect what a user types (the front door) miss attacks in systems where a planner hands work to workers, tools, memory, verifiers and synthesizers behind that door. The corpus's short answer is that in these pipelines, most of the risky text never passes through the front door at all.

Start with where the inspection happens. One note maps five internal hand-offs: planner to worker, tool to worker, memory to worker, worker to verifier, and worker to synthesizer. It finds that existing defenses watch only user input, so an injection hidden in a tool result or a stored memory travels downstream unchecked Do internal agent hops in pipelines need security monitoring?. Every component can be safe on its own while the system as a whole is not. Even the front door can be beaten on timing. FLOWSTEER shows that a crafted prompt can bias how the planner builds its workflow and raise malicious success by up to 55 percent, because the contamination enters upstream of the workflow-inspection defenses Can prompts alone reshape multi-agent workflows without system access?. The plan itself becomes the attack surface.

The deeper reason is that a boundary check judges one thing at one moment. A model-level filter can block a single output, but it can't contain an agent whose risk spreads across memory, retrieved content, tool calls and environmental reach Can a model-level filter truly contain an agent with environment access?. Stateless per-action checks can't even state a rule like "these two individually allowed steps are forbidden together," because that rule depends on history Can stateless checks ever catch sequence-level constraint violations?. Attackers exploit exactly this gap. ColluSkill refines each sub-skill against scanner feedback until every piece looks innocent while the chain's intent stays intact, reaching 96% average success across six scanners Can attackers evade skill scanners by refining individual skills?. The layer that routes a request to a particular model sits beneath prompt-level defenses too, so attackers can send requests to weaker models or make safety checks run against the wrong identity Can attackers manipulate which model handles a request?.

Stating a rule at the boundary also isn't the same as enforcing it. In one test, explicit authorization boundaries kept protected tests unmodified only when the agent's tools were also restricted, and the boundary had to name the protected state itself rather than just announce a prohibition Can explicit authorization boundaries prevent agents from modifying protected tests?.

The pattern in the fixes is to put checks where the missing context lives. SafeFlow validates the assembled workflow at the point an irreversible action is about to be committed. That reconstructs the global risk picture no single step holds, and it complements planning-boundary and per-hop defenses, since each sees attacks the others miss Where should workflow validation gates be placed for safety?. For coordinated attacks spanning several agents, the unit of defence becomes a revisable "episode" linked by observed transfers and task authority, not an isolated review of one run Should defence units span multiple executions and agents?. The counter-swarm doctrine adds three constraints: preserve relationships across executions, limit the shared resources agents can reach, and tie responses to persistent state How can operators stop coordinated agent intrusions now?. Securing a pipeline means defending the seams between its parts, not just the entrance.