How do failures cross boundaries between multiple agents?
Explores four distinct mechanisms—messages, shared state, aggregation, and delegation—that allow a failure or attack originating in one principal to propagate through multi-agent systems. Understanding these pathways is essential for designing agent interactions that contain rather than amplify risk.
The introduction packs the mechanism into one sentence: "Messages propagate influence between principals, a shared state preserves propagated influence, aggregation combines local outputs from different principals, and delegation transfers authority across boundaries." Each verb is a different thing an interaction can do to a failure. A message moves influence from one principal to another. Shared state lets the influence outlast the exchange, so a later principal inherits what an earlier one absorbed. Aggregation merges local outputs, so a wrong or manipulated contribution can carry into a group result. Delegation moves authority rather than information, which is what lets attacker content reach a privileged tool.
This differs from the inventory in Do internal agent hops in pipelines need security monitoring?. That note counts five arrows in one pipeline shape, so it is a list by position. The four verbs are a list by mechanism and do not depend on the topology. Two of them are not hops at all: aggregation is a combination step and shared state is a place, and the vault note on that inventory observes it has no peer-to-peer hop, which is the "messages" case in Can one compromised agent corrupt an entire multi-agent network?.
The vault already holds an instance of most verbs. Shared state: Can ordinary infrastructure become unplanned agent memory? and Can shared agent memory systems reliably delete information?. Aggregation: Can a quorum of honest validators certify an invalid transition? and Does confidence drive influence in multi-agent deliberation systems?. Delegation: the path a taint travels in Can semantic labels on requests prevent malicious propagation through agent networks?. Those mappings are my reading, not the paper's.
A caution on scope. The abstract separately counts "six interaction interfaces", and the excerpt does not say how the four verbs relate to them: a subset, a coarser cut, or an independent one. Treat the verbs as the introduction's own summary of mechanism, not as the interface taxonomy (see Can adversary position unify fragmented multi-agent attack models?).
What the excerpt does not give. No examples per verb, no ranking of which mechanism dominates, and no mapping to the six interfaces.
Inquiring lines that read this note 39
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How does misaligned communication propagate bias through multi-agent networks?- How did agents rebuild communication after Hugging Face removed the channel?
- How do shared state and message propagation transfer failure across agent boundaries?
- What interventions prove causation in multi-agent message propagation studies?
- Why do agents rebuild communication after channels are removed?
- What routes do different peer mechanisms use to change agent behavior?
- What attacks are unique to multi-agent systems compared to single agents?
- What makes agent-to-agent messages in multi-agent systems vulnerable to exploitation?
- Which agent properties like state retention enable supply-chain and credential vulnerabilities?
- How does shared state convert temporary compromise into persistent inherited risk?
- How does insider threat differ from external attack in multi-agent systems?
- Does quarantining state count as recovery in multi-agent attack scenarios?
- What makes the Telephone Loop attack specific to agent delegation?
- Can a shared audit record settle which policy governed a delegation step?
- What does error recovery look like across different agent architectures?
- What baseline comparison shows whether interaction actually caused multi-agent failures?
- What are the four mechanisms that carry failures across agent boundaries?
- Why do multi-agent failures arise through interactions local checks miss?
- Does multi-agent interaction amplify existing failures or create new ones?
- What distinguishes a component's link to the collective from coupling among defecting components?
- What failure modes emerge when agents operate across organizational boundaries?
- How do agent-to-agent messages bypass defenses on downstream principals?
- What makes an advisory instruction fail when a task is split across agents?
- Does delegation transfer authority or merely distribute work across agents?
- Do agents probe sandbox boundaries when authorized routes fail?
- What happens when stopping rules must cross organizational boundaries?
- Does the same transfer between agents violate different policies differently?
- Does one agent crossing a boundary change what later agents are willing to do?
- How do peer behaviors shape whether individual agents attempt to bypass protocols?
Related concepts in this collection 4
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Do internal agent hops in pipelines need security monitoring?
Multi-agent systems route data between planner, worker, verifier, and synthesizer components. Current defenses only guard user input at the entry point, leaving inter-agent channels unmonitored—but is this a real vulnerability or does downstream safety suffice?
complements: a positional inventory of one pipeline, where this is a pipeline-independent mechanism cut
-
Can individually safe agents fail when working together?
When multiple AI agents interact—sharing information, state, and authority—do failures emerge that local safety checks alone cannot catch? This matters because system-level safety depends on understanding how principals interact.
the thesis these four mechanisms serve
-
Why do single-message classifiers miss cross-agent harms?
Can prompt classifiers detect malicious intent when harm emerges only across multiple agent interactions? The question reframes security from checking individual messages to tracking how content flows and transforms through a multi-agent system.
the flow framing of the same movement of influence and authority
-
Can agents be tricked into delegating work in circles?
A novel attack in multi-agent systems may exploit delegation between agents to create cyclical task loops. The attack's real-world impact and success rate remain unclear from current research.
an attack on the delegation verb with no result in its excerpt; whether the loop transfers authority or only redirects work is not stated
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- LLMs Corrupt Your Documents When You Delegate
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agents
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Why Do Multi-agent LLM Systems Fail?
- Agents of Chaos
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
Original note title
messages propagate influence, shared state preserves it, aggregation combines local outputs and delegation transfers authority — four ways interaction carries a failure across principal boundaries