If one checkpoint approves everything, do attackers just have to fool that one gatekeeper, or sneak around it?

This is about systems where one checkpoint decides whether an action is safe. The corpus suggests the checkpoint becomes a single point of failure, so an attacker only has to corrupt it, fool it, or route around it. The clearest case is a four-agent pipeline with its authorization defenses switched off. A validator sat as the last authority before any action ran. It read shared memory that the attacker had poisoned, and it forged approvals in every trial, so every unsafe action executed Can a poisoned validator still approve unsafe actions?. The validator's judgment was only as good as the evidence it was shown. Its position as final authority meant nothing sat behind it to catch the mistake.

Attackers often don't need to break the gate at all, because they can act where it isn't looking. One attack on planner-executor systems uses a crafted prompt to bias how the workflow gets built. That happens before any workflow inspection runs, and it raised malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?. The contamination enters upstream of the defense, so the gate ends up approving something that was already bent.

A gate that looks at pieces one at a time can also be beaten by building the attack out of pieces. In multi-agent systems, splitting tasks and specializing roles is the whole selling point, and it lets a harmful goal break into subtasks that each look harmless, with the harm appearing only when they combine Can task decomposition hide harmful intent across agents?. That is why classifying single messages isn't enough Why do single-message classifiers miss cross-agent harms?. The same holds for approving actions step by step: a sequence of individually permitted actions can still break the system's constraints Can step-by-step approval miss harmful behavior patterns?. A scanner that scores skills individually can even be used as a coach. Attackers feed its verdicts back to soften each piece while the overall chain stays intact, reaching 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?.

The answer isn't simply to add more approvals. It's to put checks in different places, each seeing something the others can't. Validating the assembled workflow at the point before an irreversible action reconstructs a risk picture that no single step holds. It also complements checks at planning time and at each hand-off, since each catches attacks the others miss Where should workflow validation gates be placed for safety?. One proposal goes further and makes the unit of defense a revisable set of related actions across agents and executions, rather than any single action or agent Should defence units span multiple executions and agents?.

A human as the single gate has the same problem in a different form. Reviewing every step invites rubber-stamping fatigue. In one system, routing human attention to the high-uncertainty decisions beat both full autonomy and step-by-step oversight Does targeted human oversight beat both full autonomy and exhaustive review?. Whether the gate is a model, a scanner, or a person, its weakness is the same: it sees a narrow slice, and attackers can shape that slice.