Do internal agent hops in pipelines need security monitoring?

A modern LLM application is rarely one model call. A planner decomposes the request, workers execute subtasks by reading shared memory and calling tools, a verifier scores the workers, and a synthesizer writes the final answer. ChannelGuard's opening move is to count the arrows: planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer. Each carries text from one component to the next, and the paper's flat claim is that none of them is monitored. An instruction injected anywhere (a prompt injection in the user query, a poisoned tool result, a malicious memory entry) can travel downstream, and a single compromised worker can corrupt the final output. That last point the paper cites to prior work rather than establishing itself.

The defenses it lists (IBProtector, SmoothLLM, Llama Guard, perplexity thresholds) all inspect the user input at the door and say nothing about what flows between agents afterwards. The only other defense it recognizes is the provider's own content filter, which sits outside the application. So the coverage map is: door guarded, provider filter outside, every internal hop open. That is the sense of the paper's title, Safe Models Do Not Compose into Safe Multi-Agent Systems: each model may be aligned, but safety is a property of the wiring between them, and no model-level guarantee speaks to the wiring. The excerpt does not set a per-model safety score against a composed-system one, so the non-composition claim rests on this channel argument plus the attribution finding in Where do safety wins come from in multi-agent systems?. Does a multi-agent setting automatically signal a security effect? says why that matters: without a single-agent baseline the "unchanged" reading is not ruled out. The vault's one controlled comparison, Does multi-agent architecture make systems easier to attack?, is for a different attack (an external web-only adversary) and one model in one scenario. The pattern note Can individual components pass safety checks if the system still fails? files the wiring argument as one of three arguments that a component-level check tests a different property than the system-level one.

The vault already holds pieces of this surface, each treated as its own attack family. Can prompts alone reshape multi-agent workflows without system access? is the planner→worker hop. Can one compromised agent corrupt an entire multi-agent network? is peer messaging. Can chain-of-thought monitors detect reasoning that originates elsewhere? names retrieved documents, tools, planners and other agents as writers into context. What ChannelGuard adds is the framing that these are one surface: enumerable, with a place on every hop where a gate could sit. The inventory is a floor, not a complete map. It has no worker→worker peer hop, which is the channel Thought Virus uses. How do failures cross boundaries between multiple agents? cuts the same surface by mechanism instead of position, and two of its four verbs, shared state and aggregation, are not hops at all. One measured case of an interior channel carrying an attack sits outside this paper: in Can a poisoned validator still approve unsafe actions?, poisoned shared memory compromised the reviewing agent and the Executor acted on its forged approval in every undefended trial. That is one four-agent pipeline (60 tasks, three seeds) whose excerpt names no backend, so it shows the mechanism is real in one setting and not how common it is.

The counterargument is that many injections do enter at the door and a gate there is cheap. But tool and memory poisoning enter mid-pipeline by construction, and the paper's own limitation shows the door is not sealed either: see Why does compression defense fail at the user prompt boundary?.

A gate on every hop is also not the only answer to an open interior. Why do single-message classifiers miss cross-agent harms? argues the unit to defend is the flow and not the message, and Where should workflow validation gates be placed for safety? puts the check at the commit point. Can memory poisoning compromise decision-making even with authorization layers? reports a permission check on the action holding while the reviewing agent stayed compromised in every trial, for memory poisoning only and in one pipeline. Whether these are alternatives to per-hop gates or layers with them is an open tension in ops/tensions/.