Why does prompt hardening work for single agents but not multi-agent systems?

Prompt hardening, in the usual sense, means adding security instructions to an agent's prompt; the excerpt does not define it. The paper tests it in Header Heist and reports an asymmetry: "prompt hardening applied to SAS reduces payload exposure by 40-75% because the agent preemptively avoids navigating to the malicious site. In contrast, identical hardening in MAS yields no such reduction." The mechanism they credit in the single-agent case is preemption. The hardened agent declines to go to the site at all, so the payload is never seen. In the multi-agent case exposure is not reduced.

The authors' explanation is an inference, and they mark it as one: "This implies that MAS configurations fragment contextual awareness (TV3 in Section 3.2), reducing agent ability to preemptively halt an attack." The vault's elaboration, not the paper's: a defensive instruction only works if the agent holding it also has the context to recognize the situation it applies to. Split the task across agents and the agent that decides to navigate may not be the agent holding the security instruction, or may not know why it is navigating. Nothing in the excerpt tests this. It reports the outcome and offers TV3 as the reading, without an ablation that restores context and checks whether hardening comes back.

The practical stake is defensive. A defense validated on a single agent (a sentence added to a prompt) may not transfer when the same job is decomposed, and the failure is silent: the prompt still says the right thing. That is the architecture-level companion to the position-dependence in How does a signal's position in a workflow change its influence?, where a signal sits in the graph decides how far it travels. It also sits awkwardly with Can delegation teach models to manage context more actively?, which treats partitioned context as the point of delegation (see the tension recorded in ops/tensions).

The same partition shows up in later notes from other papers, and each pairing below is the vault's reading, not the paper's. Can task decomposition hide harmful intent across agents? is the attacker's side of it: a harmful objective split until no agent sees it whole, where here the awareness that would stop an attack is split. Where should workflow validation gates be placed for safety? is one design answer, rebuilding the context at the commit point; the hardening result is the case where the other answer, an instruction in the prompt, did not reduce exposure once the task was split, and the excerpt does not say which agents carried it. A hardening sentence is also advisory guidance in the sense of Can stateless checks ever catch sequence-level constraint violations?, but that note's limit (advisory text cannot state a constraint on a sequence) is not the one at work here, since the instruction cut exposure for one agent's navigation decision and stopped doing so when the work was divided. Withholding context is not always a safety loss either: Does limiting interaction history actually prevent agent collusion? finds the reverse for a different behavior, so which context is withheld may decide which way it cuts.

What the excerpt does not give. The range 40 to 75 percent is stated without saying what it spans (models, prompts or runs). TV3 is named but its definition and the rest of the taxonomy sit in Section 3.2, outside the excerpt. No hardened-MAS number is given, only that there is "no such reduction."