Can task decomposition hide harmful intent across agents?

Multi-agent systems get their capability from two moves: split the task, and give each agent a specialized role. SafeFlow (2607.25255) argues that "these same mechanisms introduce an important safety blind spot: a harmful objective can be fragmented into locally plausible subtasks, allowing malicious intent to evade detection by any single agent." The paper's illustration is a three-step exfiltration. One agent retrieves sensitive content, another rewrites it, and a third transmits it, "such that no individual step looks overtly malicious, yet the composed workflow realizes exfiltration or policy override."

What separates this from the injection attacks the vault already holds is where the harm lives. In How does a signal's position in a workflow change its influence? and Can one compromised agent corrupt an entire multi-agent network?, a hostile signal is present somewhere: in a message, in an agent's context, in a bias carried between agents. Here, as the excerpt frames it, every message is individually ordinary and the malice sits in the originating objective, not in a compromised agent. The vault's case of a compromised agent, where one agent's objective is the changed part and specialized roles are named as an exacerbating factor, is Does one misaligned agent harm a team in adversarial settings?. That result is reported in an abstract with no effect size and this claim is argued, so the two are not a joint finding. Retrieving, editing and sending are what these agents are for. A per-agent or per-message check has nothing to object to, because the property it tests, "is this step harmful?", is false at every step. The harm is a property of the sequence. The authors name the general shape in one line: "harmful behavior often emerges compositionally."

The strongest objection is that the last step of the example, sending sensitive content out, is the kind of thing a check at the sink can catch without any flow analysis. That works only if the sink can still recognize the content as sensitive after the middle agent has reworded it, which is the difficulty picked up in Why do single-message classifiers miss cross-agent harms? and How does SafeFlow track sensitivity through agent rewrites?.

There is also a cost-side reading for the multi-agent design ledger. When do multi-agent systems actually outperform single agents? argues that the motivations for decomposition weaken as single agents get better. If decomposition is also what makes fragmentation possible, the attack surface is a price of the architecture, not a bug in a particular system. That is a vault inference; the paper does not make it. A measured single-versus-multi gap now exists for a different attack, Does multi-agent architecture make systems easier to attack?, and it leaves this reading where it was for fragmentation itself: that gap is an external web injection in one scenario with one model, and no comparison has been run for a fragmented objective.

What the excerpt does not give. The source is an abstract and one introduction paragraph. It reports no rate at which fragmentation succeeds against per-agent defenses and no single-agent comparison. The failure mode is argued, not measured.